CVE -2026-104286 is a critical vulnerability in FortiMail that is already being exploited in zero-day attacks. Fortinet says that an unauthenticated attacker could, with a specially crafted HTTP or HTTPS request, write arbitrary files to the system. The company rates the vulnerability at CVSS 9.8 and urges administrators to mitigate exposure immediately.
CVE -2026-104286, with advisory code FG-IR-26-175, concerns the graphical management interface of the FortiMail appliance. Fortinet's official announcement confirms that the exploit has been observed online. The vulnerability was discovered internally by Gwendal Guégniaud of Fortinet's product security team. Neither the number of compromised installations nor the identity of the perpetrators have been disclosed, so the extent of the attacks remains unclear.
How the FortiMail vulnerability works
The issue combines bypassing file path restrictions with inadequate null byte parsing. As a result, a request arriving in the exposed environment could direct the write outside the intended directory. The exploit requires no account or user action.
The ability to write arbitrary files to FortiMail is particularly serious for an email security appliance that handles corporate email. If an attacker gains access to the management interface, they could create the conditions for executing unauthorized commands or gaining further access. Fortinet attributes the vulnerability to an impact on confidentiality, integrity, and availability.
For CVE-2026-104286, the company's report does not specify when the exploit began or how many organizations were affected. However, it does include files and logs that can help with incident investigation. Among the clues are changes to system files, unknown cron jobs, and remote archiving account settings.
The network traces published by Fortinet include the addresses 79[.]141.169.187 and 45[.]129.0.192. The company also lists a record of an archive account being created with a remote destination at one of these addresses. The traces do not prove a breach in themselves, but they help identify suspicious changes and outbound connections.
See also: FortiVoice: Fortinet fixes critical zero-day vulnerability
FortiMail versions affected by CVE-2026-104286
Fortinet lists FortiMail versions 8.0.0 to 8.0.1, 7.6.0 to 7.6.6, 7.4.0 to 7.4.8, and 7.2.0 to 7.2.9 as vulnerable. For the 8.0, 7.6, and 7.4 series, the advisory states that patched versions 8.0.2, 7.6.7, and 7.4.9 are expected. For the 7.2 series, the recommended course of action is to upgrade to the 7.4 series or later. Installations of these series should be specifically checked for CVE-2026-104286.
FortiMail administrators should check both active devices and any backup or virtual installations. Units whose management environment is accessible from the Internet are given special priority. BleepingComputer reports that at the time of the warning, patches for versions 7.4, 7.6, and 8.0 were not available.
CVE -2026-104286 has been added to CISA’s Known Exploited Vulnerabilities list. For U.S. federal agencies, the listing sets a deadline of October 4th and requests a digital investigation for evidence of a breach. The NVD listing references CISA’s guidance on the matter; the deadline is a U.S. federal policy and is not a general legal requirement for any agency.
See also: Fortinet patches critical RCEs in FortiAuthenticator and FortiSandbox
Immediate measures and control for CVE-2026-104286
For FortiMail installations, until a suitable fix is implemented, Fortinet recommends disabling Identity-Based Encryption (IBE), following the advisory guidelines. To do this, run the config system encryption ibe, set status disable , and end. Alternatively, administrators can remove access to the management environment from the internet or restrict it to trusted private networks. An organization should weigh disabling IBE against whether its users rely on this feature.
For systems suspected of being compromised, the SecNews technical team recommends first maintaining logs and checking the indicators published by Fortinet. A simple upgrade is not a substitute for examining for possible data access or corruption. If found, incident handling by the relevant security team is required and credentials that may have been exposed must be changed.
See also: Ivanti, Fortinet and Splunk release security updates
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
CVE -2026-104286 combines a confirmed exploit with a severe impact and therefore requires immediate assessment of system exposure. Organizations should implement vendor guidance, restrict access to the management interface, and monitor for patch release announcements.
