CVE-2026-104286: FortiMail Unauthenticated Arbitrary File Write Zero-Day Under Active Exploitation

The FortiMail zero-day tracked as CVE-2026-104286 allows an attacker to write an attacker-controlled file to any path on a FortiMail appliance’s filesystem by sending a single unauthenticated HTTP request to the Identity-Based Encryption feature’s request handler. The request does not require a session token. It does not require any prior interaction with the appliance. It does not require knowledge of any admin credentials or internal configuration. It requires only that the IBE feature be present and that the management interface be reachable. The result is a network-reachable, pre-authentication arbitrary file write on the organization’s mail transfer agent, rated CVSS 9.8 Critical.

Fortinet’s internal Product Security Incident Response Team discovered the vulnerability, attributed to researcher Gwendal Guégniaud. The advisory, FG-IR-26-175, was published on October 1, 2026, the same day CISA added CVE-2026-104286 to its Known Exploited Vulnerabilities catalog. A KEV listing on the day of disclosure is the clearest available signal that exploitation in the wild predated the advisory. The window between when the vulnerability was first exploited and when defenders received any official notification is unknown.

Federal civilian agencies were given until October 4, 2026, three days, to demonstrate mitigation under Binding Operational Directive 26-04. Fixed releases for the 7.4, 7.6 and 8.0 branches were listed as upcoming when the advisory was first published and are now available, so the workaround is a bridge rather than a destination. The 7.2 branch still has no fix of its own. The three-day window was never only a patching deadline: the KEV entry carries a forensic triage requirement, so it also asks organizations to investigate, document exposure status and produce evidence that they looked.

Root Cause: How the Unauthenticated File Write Works

Source: Fortinet PSIRT Advisory FG-IR-26-175, October 2026

The root cause is a combination of two input validation failures in the IBE request handler: insufficient path validation and failure to neutralize null bytes before passing the filename to the filesystem layer. When FortiMail receives an IBE-related request through the management interface, it processes a file path parameter as part of the request. The validation logic checks that the path ends in an acceptable extension. It does not adequately reject path traversal sequences that allow escaping the intended write directory.

Identity-based encryption is a legitimate enterprise capability for sending encrypted email to recipients who do not have pre-installed certificates or pre-shared keys. It is present in many enterprise FortiMail deployments by default or through setup wizard selection, which means organizations that never consciously deployed IBE were carrying its code path in their attack surface. The IBE handler is reachable on the management interface without any authentication, because it is designed to handle enrollment and key retrieval operations that may be initiated by external mail clients.

Affected Versions and Fixed Releases

Source: Fortinet PSIRT Advisory FG-IR-26-175, October 2026

Detecting the FortiMail Zero-Day: What the Advisory Publishes, and What It Does Not

The persistence mechanisms used in active exploitation of CVE-2026-104286 leave filesystem and network artifacts that forensic investigation can identify. Fortinet’s advisory publishes two IP addresses and a set of log strings. The filesystem artifact locations and hashes in the table below come from incident reporting rather than from the advisory IoC section, so treat them as hunting input and compare them against your own vendor firmware manifest. The critical caveat is that one of the primary persistence mechanisms, replacement of the logging library at /data/lib/liblog.so, directly compromises the integrity of FortiMail’s own application logs. An investigation that relies exclusively on FortiMail-native logging to determine whether exploitation occurred cannot be considered complete: the logging subsystem itself is a target. External log sources, firewall logs, and NetFlow records are more reliable evidence when liblog.so may have been replaced.

Sources: Fortinet PSIRT Advisory FG-IR-26-175, October 2026, for the IP addresses and log strings; independent incident reporting, October 2026, for the file paths and hashes

Immediate Actions

Priority 1: Move to a Fixed Release, and Reduce Reachability Until You Do

• Disable the IBE feature on all FortiMail appliances using the CLI. Execute: config system encryption ibe / set status disable / end. Confirm the change with: config system encryption ibe / show. This removes the code path through which CVE-2026-104286 is exploited.
• If IBE is used operationally to deliver encrypted email to recipients without pre-installed certificates, disabling it has consequences for those email flows. As a partial alternative, restrict access to the FortiMail management interface to trusted private network IP ranges only, removing internet reachability of the attack surface.
• Organizations on FortiMail 7.2.x have no planned patch release for that branch. Migration to 7.4 or later is required to reach a fixed build. Begin migration planning immediately; this is a version migration with its own testing and change window, not a maintenance update.
• Organizations on 7.4, 7.6 or 8.0 branches should apply the fixed release now rather than monitor Fortinet’s advisory page for patch availability: 7.4.9, 7.6.7 and 8.0.2 and above are published.

Priority 2: Investigate for Compromise Before Concluding Mitigation Was Applied in Time

• Check for any file at /data/etc/ld.so.preload. This path should be absent on a clean FortiMail installation. Any file present at this location indicates library preload hijacking and should be treated as a confirmed compromise indicator.
• Compare the SHA-256 hash of /data/lib/liblog.so against the expected hash for the installed FortiMail firmware version. If the hash does not match the vendor manifest, the logging library has been replaced and application logs from that appliance cannot be trusted as a complete record.
• Check /data/bin/ for the presence of webconsole (not a standard FortiMail binary) and compare /data/bin/mailservice and /bin/smit against vendor-provided firmware manifests.
• Review the FortiMail admin user list for accounts created outside normal provisioning. The attacker-observed account name is archive234 with a remote relay server configuration.
• Check system crontab (crontab -l and /etc/cron.*) for entries referencing /migadmin or unfamiliar binary paths.
• Search web server access logs for %2e%2e, %252e (double-encoded dot), or %00 in any URI path field. These patterns indicate exploitation attempts or successful traversal requests against the IBE handler.
• Review external firewall and NetFlow logs for established outbound connections from the FortiMail management interface IP to 79.141.169.187 or 45.129.0.192. Because liblog.so may have been replaced, external evidence is more reliable than appliance-native logs.

Priority 3: Post-Mitigation Verification and Hardening

• Confirm that the IBE status change persisted after any FortiMail service restarts. Re-run: config system encryption ibe / show and verify status is disabled.
• Configure FortiMail log forwarding to an external SIEM or log management platform before proceeding with any remediation on a potentially compromised appliance. If liblog.so has been replaced and the appliance is rebooted or serviced without preserving the current log state, forensic evidence on the appliance itself may be lost.
• Document investigation findings, the date and time the IBE workaround was applied, and the results of IOC checks. Federal civilian agencies must produce evidence of a triage posture, not only a patch record, to satisfy BOD 26-04 compliance.

Context: Why FortiMail Is a High-Value Target

FortiMail is a mail transfer agent: the system that receives, inspects, filters, stores, and routes every inbound and outbound email for the organizations that deploy it. A compromised FortiMail appliance gives an attacker access to email content and attachments for all mail flowing through the organization’s infrastructure, visibility into mail account authentication events that pass through the MTA, and control over the routing and delivery of organizational email. These capabilities are relevant both for intelligence collection and for subsequent attacks: phishing campaigns launched from inside a trusted mail infrastructure, business email compromise that exploits harvested credential data, and supply chain attacks that use the compromised MTA’s trusted network position to reach internal mail servers.

The network position of a FortiMail appliance amplifies this access. Internal mail servers receive email from FortiMail and trust it implicitly as the organization’s designated relay. An attacker with persistent access to a compromised FortiMail appliance has a foothold inside the mail relay trust chain that is significantly harder to detect than a compromised workstation or external server, because FortiMail-originated traffic matches expected patterns for legitimate mail flow.

The broader pattern matters for context. CVE-2026-104286 follows other recent critical vulnerabilities in email security appliances and mail transfer agents, each exploited in the wild before defenders had patch coverage. In each case, the attack surface was the appliance’s primary function: the code path that handles the mail flow or management operations the appliance exists to perform. Appliance-category vulnerabilities are increasingly targeted because appliances sit at the perimeter with privileged network positions, run specialized operating environments that are often less monitored than endpoint infrastructure, and are frequently deployed in configurations where management interfaces are more accessible than security policy intends.

Attribution for CVE-2026-104286 exploitation has not been publicly established as of October 2026. The CISA KEV listing confirms active exploitation; the identity of the threat actors and their specific objectives are not documented in public sources at time of publication.

Source: Fortinet PSIRT Advisory FG-IR-26-175, October 2026; CISA KEV Catalog, October 2026

Brandefense Coverage for CVE-2026-104286

RELATED READING

Two NetScaler Zero-Days, One Wrong Assumption: Why Patching Does Not Close the Incident https://brandefense.io/blog/netscaler-zero-day-cve-2026-88771-response/ : A parallel case study in pre-authentication vulnerabilities on network appliances: exploitation chain, forensic artifacts, and CISA response compared to CVE-2026-104286

CVE-2026-76461: Cisco Secure Email Gateway SQL Injection Zero-Day Under Active Exploitation https://brandefense.io/blog/cve-2026-76461-email-gateway-sql-injection/ : The other mail security appliance zero-day of the quarter, for readers now auditing the whole mail edge rather than one box

Shadow IT: Why the Assets Your IT Team Doesn’t Know About Are Your Most Dangerous Entry Points https://brandefense.io/blog/shadow-it-hidden-attack-surface/ : Why a feature switched on once and never reviewed is the category this vulnerability actually belongs to