FortiMail Zero-Day CVE-2026-104286 Exploited: Disable IBE Now, Patch Is 'Upcoming'

What Happened

On 1 October 2026, Fortinet published advisory FG-IR-26-175 for CVE-2026-104286, a critical unauthenticated flaw in the FortiMail secure email gateway. The advisory states plainly that the issue "has been reported to be exploited in the wild" and urges customers to apply the workaround immediately. CISA added the CVE to its Known Exploited Vulnerabilities catalog the same day, setting a remediation deadline of 4 October 2026 for federal civilian agencies under Binding Operational Directive 26-04.

The vulnerabilityVulnerability🛡️A weakness in software, hardware, or processes that can be exploited by attackers to gain unauthorized access or cause harm. carries a CVSS 3.1 base score of 9.8 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Fortinet classifies it as two weaknesses working together: CWE-22, a path traversalPath Traversal🛡️A web vulnerability (CWE-22) where user-supplied input in a file path escapes the directory the application intended to serve from, typically via parent-directory references, letting an attacker read or write files elsewhere on the server., and CWE-158, improper neutralization of a NULL byte. In combination they let an unauthenticated attacker write arbitrary files to the underlying system through crafted HTTP or HTTPS requests to the management GUI. Fortinet credits internal discovery to Gwendal Guégniaud of its Product Security team, and NVD's SSVC decision marks exploitation as active, automatable as yes, and technical impact as total.

Fortinet has not said when the attacks began, how many customers were hit, or who is behind them. What the advisory does provide is an unusually detailed set of indicators of compromise, which tells you the vendor has forensic artifacts from real intrusions rather than a theoretical proof of concept.

How the File Write Works

The flaw lives in the FortiMail management interface, the component Fortinet labels simply "GUI." A path traversal lets an attacker aim a write outside the directory the web server is supposed to confine it to. The NULL byte neutralization failure is the second half of the primitive: a terminator embedded in the request manipulates how the filename is parsed, which is a classic way to defeat extension checks and land a file at a chosen path. Together they turn "upload something to a scratch directory" into "write a file of my choosing anywhere the web process can reach."

Fortinet's IoC list shows what attackers did with that primitive. They dropped a shared object at `/data/lib/liblog.so` and registered it through `/data/etc/ld.so.preloadld.so.preload🛡️A Linux file read by the dynamic linker that lists shared libraries to load into every dynamically linked process before any other library. Designed for legitimate interposition, it is a favored persistence mechanism: writing a path into it forces attacker code to load into processes system-wide, including root-owned ones.`, the Linux mechanism that forces a library to load into every dynamically linked process. That is how a single file write becomes persistent code execution on the appliance. Other artifacts include added binaries at `/data/bin/webconsole` and `/data/bin/mailservice`, a modified `/bin/smit`, and a tampered `/data/etc/httpd.conf`. One system event log in the advisory shows the intruder adding an archive account named `archive234` pointed at a remote host, 79.141.169.187, to exfiltrate mail. A second attacker IP, 45.129.0.192, also appears. The jump from a write primitive to a running implant is the subject of our explainer, How an Arbitrary File WriteArbitrary File Write🛡️A vulnerability class in which an attacker controls both the contents and the destination path of a file written by a target system. On a general-purpose OS it is usually equivalent to code execution, because files written to certain locations are loaded or run automatically. Becomes Code Execution Through ld.so.preload.

Who Is Affected

Every on-premises FortiMail appliance running an affected build is exposed if its management interface is reachable. Fortinet's fixed-version table is the authoritative source:

• FortiMail 8.0.0 through 8.0.1 — upgrade to 8.0.2 or above
• FortiMail 7.6.0 through 7.6.6 — upgrade to 7.6.7 or above
• FortiMail 7.4.0 through 7.4.8 — upgrade to 7.4.9 or above
• FortiMail 7.2.0 through 7.2.9 — upgrade to branch 7.4 or above

At publication the fixed 8.0.2, 7.6.7, and 7.4.9 builds were listed as "upcoming," which is the detail that should shape your response. For much of the exploitation window there was no patch to install, only a workaround to apply. NVD's configuration data also flags the 7.0 train as affected, so appliances on older long-term branches should not assume they are out of scope. FortiMail Cloud customers should confirm their posture with Fortinet rather than assume the hosted service is unaffected.

The risk is not limited to the mailflow this box carries. A secure email gateway terminates TLS, scans content, stores quarantined and archived messages, and often holds the keys for encrypted delivery. Root on that appliance is read access to a large volume of corporate mail and a foothold inside the security perimeter.

Immediate Actions

Apply Fortinet's workaround now, then patch as soon as a fixed build is available for your branch. The advisory gives two mitigations:

• **Disable the IBE feature.** The Identity-Based EncryptionEncryption🛡️The process of converting data into a coded format that can only be read with the correct decryption key. service is the exposed surface. Turn it off in the GUI under Encryption, IBE, IBE Service, or from the CLI:

``` config system encryption ibe set status disable end ```

• **Restrict the management interface.** Block access to the FortiMail management GUI from the internet and permit it only from a trusted private network. This is good practice independent of this CVE, and it is the control that would have blunted the attack entirely.

Disabling IBE is not free: it is the feature that lets external recipients retrieve encrypted mail through a web portal, and many organizations enabled it to meet a compliance obligation. Switching it off to dodge a zero-dayZero-Day🛡️A security vulnerability that is exploited or publicly disclosed before the software vendor can release a patch, giving developers 'zero days' to fix it. is a business decision as much as a configuration change, which we cover in Why Disabling a Feature to Dodge a Zero-Day Is a Business Decision.

Because exploitation predates most patches, assume the workaround alone does not clear you. Hunt for the indicators Fortinet published. Verify the SHA-256 hashes of `liblog.so`, `smit`, `webconsole`, and `mailservice`, inspect `/data/etc/ld.so.preload` and `/data/etc/httpd.conf` for tampering, review your archive and admin account configuration for unfamiliar entries, and search logs for connections to 79.141.169.187 and 45.129.0.192. Building a repeatable version of that check is covered in How to Detect Unauthorized File Changes on a Hardened Appliance. If you find artifacts, treat the appliance as fully compromised and follow Fortinet's forensic triageForensic Triage🛡️A rapid, structured assessment of whether a system was compromised, performed alongside patching rather than after it. It prioritizes evidence the attacker could not have altered, such as network egress and authentication logs on other systems, over the affected host's own logs. guidance before you rebuild. Our existing guide, How to Check an Email Security Gateway for Compromise After a Zero-Day, walks through the broader containment sequence.

Long-Term Outlook

This is the second mail-server zero-day to draw CISA's attention in recent weeks, following the Zimbra SNMP flaw in August, and it fits a durable pattern: internet-facing management interfaces on security appliances are among the most heavily hunted targets on the network. The lesson is not specific to Fortinet. Any appliance whose administrative GUI faces the internet is one parser bug away from the scenario above. Pull those interfaces behind a VPN or a management network, inventory which of your appliances still expose them, and treat "no patch yet" as a prompt to disconnect rather than wait. The vendors will keep shipping fixes; the exposure is yours to close before the next advisory lands.

Sources

• Fortinet PSIRT advisory FG-IR-26-175: https://fortiguard.fortinet.com/psirt/FG-IR-26-175
• NVD entry for CVE-2026-104286: https://nvd.nist.gov/vuln/detail/CVE-2026-104286
• CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• BleepingComputer, "Fortinet warns of critical FortiMail flaw exploited in zero-day attacks": https://www.bleepingcomputer.com/news/security/fortinet-warns-of-critical-fortimail-flaw-exploited-in-zero-day-attacks
• The Hacker News, "Critical FortiMail Zero-Day Flaw Exploited in Attacks": https://thehackernews.com/2026/10/critical-fortimail-zero-day-flaw.html
• The Register, "Fortinet sounds the alarm over actively exploitedActively Exploited🛡️A vulnerability that attackers are currently using in real-world attacks, requiring immediate patching regardless of severity score. FortiMail zero-day": https://www.theregister.com/security/2026/10/02/fortinet-sounds-the-alarm-over-actively-exploited-fortimail-zero-day/