FortiMail zero-day CVE-2026-104286 exploited before a patch was available

What happened

On 1 October 2026 Fortinet disclosed CVE-2026-104286, a critical vulnerability (CVSS 9.8) in its FortiMail email security gateway, and confirmed it is being exploited in the wild. The flaw combines path traversal with improper handling of NULL bytes. An unauthenticated attacker can send crafted HTTP or HTTPS requests to write arbitrary files to the underlying system, which can lead to code execution. CISA added it to its Known Exploited Vulnerabilities catalogue the same day.

Who is affected

FortiMail 8.0.0 to 8.0.1, 7.6.0 to 7.6.6, 7.4.0 to 7.4.8 and 7.2.0 to 7.2.9.

What to do now

• No fixed release was available when the advisory was published. Apply Fortinet's workaround: disable IBE feature support, or block internet access to the FortiMail management interface and allow it only from trusted private networks.
• Install the fixed release as soon as Fortinet publishes it.
• Hunt for compromise. Indicators published by Fortinet show attackers implanting persistent code and changing mail archiving to send copies of messages to attacker infrastructure. Review archiving settings and recent configuration changes.

Why it matters for SOC teams

An email gateway sees every message. A quiet change to archiving rules can leak mail for weeks without triggering a classic malware alert, which is why configuration changes on security appliances deserve the same attention as endpoint alerts. Read our analysis of this month's edge device zero-days.