FortiMail Zero-Day Puts Attackers on the Mail Path

Fortinet says attackers are exploiting a FortiMail zero-day that writes files to the box with no login. The flaw, CVE-2026-104286, carries a CVSS score of 9.8.

CISA added it to the Known Exploited Vulnerabilities catalog on October 1, 2026, and set a due date of October 4 for U.S. federal civilian agencies. Fortinet’s own advisory still listed the fixed builds as upcoming.

Federal Agencies Faced a Sunday Deadline Without a Full Patch Set

Binding Operational Directive 26-04, issued June 10, 2026, replaced older two-week KEV clocks with a risk model that can shrink to three calendar days and forensic triage. CVE-2026-104286 landed in that top tier: it is known exploited, reachable over the network, and Fortinet rates the impact as executing unauthorized code or commands.

October 4, 2026 was a Sunday. Covered agencies had to apply vendor mitigations and check whether the appliance was already compromised. CISA’s catalog also says agencies should follow the cloud guidance in that directive, or discontinue use if mitigations are unavailable. The listing marks known ransomware use as unknown.

Canada’s Communications Security Establishment published alert AV26-989 on October 1 and updated it on October 2, repeating Fortinet’s version table and the in-the-wild warning. Private firms do not inherit the federal due date, but the KEV tag is how operators now rank edge bugs.

THE FOUR-DAY CLOCK

1. June 10, 2026: CISA issues BOD 26-04, setting a three-day clock plus forensic triage for the highest-risk KEV cases.
2. October 1, 2026: Fortinet publishes FG-IR-26-175 and CISA adds CVE-2026-104286 to the catalog, due October 4.
3. October 2, 2026: Fortinet’s document library posts FortiMail 7.6.7 release notes (build 858); 7.4.9 notes carry the same October 2 header.
4. October 3, 2026: The 7.4.9 changelog records the initial release of those notes (build 630).
5. October 4, 2026: The federal due date lands. Fortinet’s PSIRT table still says 8.0.2, 7.6.7 and 7.4.9 are upcoming.

That split is the operational mess. One product line had notes in the library before Sunday. The security advisory customers actually open still told them to wait.

Unauthenticated File Writes on the Mail Gateway

FortiMail is the appliance that sits in front of corporate email and decides what is delivered, quarantined or blocked. CVE-2026-104286 lives in the GUI, not in the SMTP engine. Fortinet describes a path traversal (CWE-22) plus improper handling of a null byte (CWE-158). Crafted HTTP or HTTPS requests can write arbitrary files on the system underneath.

This has been reported to be exploited in the wild, customers are urged to apply the workaround below.

Fortinet PSIRT, advisory FG-IR-26-175, October 1, 2026

No password is required. Attack complexity is low. User interaction is none. Fortinet scores confidentiality, integrity and availability all high. The company says writing files to certain locations can let an attacker run code or commands on the appliance.

Gwendal Guégniaud of Fortinet Product Security found the bug internally. The advisory still flags Known Exploited as yes. There is no virtual patch. Operators who expected a FortiGuard IPS signature to buy time do not get one.

Seemant Sehgal, chief executive of BreachLock, said an unauthenticated file write is enough to plant a web shell, steer mail through attacker kit, steal admin logins, and use the gateway as a foothold. That is the mail-filter problem in one line: the box that reads everyone’s messages is also a management plane on HTTP.

Which FortiMail Versions Still Need a Workaround?

FG-IR-26-175 names four supported trains. The 7.2 row has no in-branch fix. Those customers are told to move onto 7.4 or later, and 7.4 itself is listed as vulnerable through 7.4.8, so a bare branch jump is not a patch.

FORTINET’S AFFECTED TRAINS

The FortiMail 7.4.9 release notes say that mature build 630 is no longer vulnerable to CWE-22 path traversal. Hardware listed includes the 200F, 400F, 900F, 2000E, 2000F, 3000E, 3200E and 3000F, plus the usual VM hypervisors. Fortinet’s document library also posted 7.6.7 notes on October 2. The PSIRT table was not updated to match either document when agencies were racing the Sunday clock.

NIST’s National Vulnerability Database repeats Fortinet’s 8.0, 7.6, 7.4 and 7.2 ranges in its description. A separate NVD product block also lists 7.0.0 through 7.0.9. Fortinet’s customer table does not mention 7.0, so the working map for operators is the advisory, not that extra NVD row.

The IBE Portal Attackers Already Use

Fortinet’s first workaround is to turn off Identity-Based Encryption. In the GUI that is Encryption, then IBE, then IBE Service off. On the CLI it is three lines: config system encryption ibe, set status disable, end.

IBE is how FortiMail sends encrypted mail to people outside the company. The recipient either gets an encrypted attachment or opens a pickup page on the FortiMail web interface. That page is supposed to be reachable. The bug is in that web path. Fortinet even tells operators who run a web application firewall to block POST requests to /ibe that contain ‘../’.

Turning IBE off stops that encrypted-delivery workflow. Ordinary spam filtering and inbound mail still run. Legal, HR and finance teams that stamp outbound mail as secure lose the FortiMail method until a fixed build is installed. The second workaround is to pull the webmail and management interface off the public internet, or limit it to a trusted private network. If outside partners must keep using the pickup portal, that option fights the product’s job.

WHAT FORTINET SAYS TO DO NOW

• Disable IBE: Switch the IBE service off in the GUI or with the CLI sequence above if the shop can live without encrypted pickup mail.
• Hide the GUI: Stop internet access to FortiMail webmail and administration, or allow only a trusted private network.
• WAF rule: If a web application firewall sits in front, block POST requests to /ibe that contain ‘../’.

Those controls are containment, not a clean bill of health. Fortinet is clear that a workaround does not remove files or persistence an attacker already planted. Shops that needed IBE left on, and left the portal on the internet, spent the CISA window with the attack surface still open.

Two IPs and an archive234 Account

The advisory publishes hunter material from the campaign, not a victim count and not an attributed group. The IP list is short: 79.141.169.187 and 45.129.0.192.

INDICATORS FORTINET PUBLISHED

• Remote archive job: A config event adds archive account archive234, rotation size 50, sending to remote IP 79.141.169.187, user archive234, directory /uploads.
• Cron on the box: A debug system event shows root cron running /bin/sh with O=/migadmin.
• Ghost admin session: An admin logout is logged as success from (null), reason unknown.
• IBE decoder errors: Encryption logs catch a BufferException for invalid Base64 at position 0, character 0x2a, plus failed logins for internal users written as *@domain.tld.

That archive234 job is the specimen. Someone with no login wrote enough of a foothold to add a mail-archive account and point it at an IP Fortinet later published. Roman Y. Sannikov, global research coordinator at iCounter, said the same campaign also shows up as changes to ld.so.preload, an extra liblog.so, and a modified web server config. ld.so.preload is a Linux trick that loads a library into every process. Operators who only delete a dropped webconsole binary can miss that.

Hunt the two IPs, the archive account name, the /migadmin cron line, and preload-style libraries before anyone declares the gateway clean. A version number that is still on the affected list is exposure. Those log lines are evidence of a visit.

A Summer of Stolen FortiGate Logins

This is not Fortinet’s first ugly appliance week of 2026. In June, researchers described a credential dump, nicknamed FortiBleed, covering logins tied to around 75,000 FortiGate firewalls. Fortinet’s PSIRT blog said the activity reused credentials from previous incidents and brute-force against weak passwords and boxes without multi-factor login. The company said it was not a new Fortinet vulnerability and not tied to a fresh advisory.

The two events are different tools. June was stolen and guessed firewall logins. October is an unauthenticated file write on the mail gateway. They share a habit attackers already have: Fortinet edge gear that is reachable from the internet, with a management plane that was never meant to be a public service. CISA’s three-day model assumes the vendor has a build to install. FG-IR-26-175 told customers several of those builds were still coming.

Workarounds Leave Planted Files in Place

BOD 26-04’s forensic triage line is the part a patch ticket does not cover. Agencies had to ask whether the asset was already owned, in the same three-day window they were arguing over change control. For everyone else, the same sequence still holds: lock down IBE or the GUI, then look for archive234, the two IPs, odd cron, and preload libraries.

7.2 fleets still need a branch migration onto a 7.4 build that is actually fixed, not a jump onto 7.4.8. 8.0 customers were still staring at an upcoming 8.0.2 line on the PSIRT page after the federal due date. Shops that depend on IBE for partner mail cannot take the pickup portal off the internet without breaking that mail. Those are the boxes that stay interesting after October 4.