Critical Path Traversal in Fortinet FortiMail Under Active Exploitation (CVE-2026-104286)

Executive Summary

On October 1st, 2026, Fortinet disclosed a critical vulnerability in its FortiMail email security gateway and confirmed it has been exploited in the wild. Tracked as CVE-2026-104286, the flaw lets an unauthenticated, remote attacker write arbitrary files to the underlying system through crafted HTTP or HTTPS requests, which Fortinet states can lead to the execution of unauthorized code or commands. CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog the same day. 

FortiMail sits in the mail flow of the organizations that deploy it, inspecting every inbound and outbound message. A compromised appliance gives an attacker a persistent position with direct access to email traffic. Indicators published by Fortinet show attackers implanting persistent code and reconfiguring mail archiving to send copies of messages to attacker infrastructure. Fortinet has named fixed versions, but at the time of writing they are listed as upcoming releases. 

Given confirmed zero-day exploitation, the sensitivity of the mail these appliances process, and the frequent targeting of Fortinet edge devices, Beazley Security recommends affected organizations apply the vendor workarounds immediately, upgrade as soon as fixed releases ship, and conduct a thorough review for any signs of compromise. 

Affected Systems or Products

Fortinet has confirmed in their advisory that the following versions of FortiMail are vulnerable if they have Identity-Based Encryption (IBE) enabled. This appears to be predicated on the web interface for FortiMail being present and internet accessible. We do not see information that identifies the SMTP component being compromised by this vulnerability.

Mitigations / Workarounds

Until fixed releases are available, apply one of the workarounds Fortinet provides.

Public reporting places the flaw in the IBE component, and disabling IBE is Fortinet's primary workaround. Doing so disables the secure message service, and recipients who read encrypted mail through the FortiMail portal will lose access until it is re-enabled.

1. 1.

   Disable IBE feature support from the FortiMail CLI: config system encryption ibe set status disable end

2. 2.

   Disable access to the FortiMail management interface from the internet, or restrict it to trusted private networks only.

Neither workaround removes an attacker who has already compromised the appliance. Before changing configurations, export logs and configuration so evidence is preserved. FortiMail 7.2 customers should note that moving to the 7.4 branch only remediates the flaw once 7.4.9 is installed, since current 7.4 builds remain vulnerable. 

Patches

Fortinet has identified FortiMail 8.0.2, 7.6.7, and 7.4.9 as the fixed releases, but they had not shipped at the time of writing. A single upgrade to the fixed release for your branch remediates the vulnerability. Additional information, including release availability, can be found in the official Fortinet advisory FG-IR-26-175.

Indicators of Compromise

The same day as the Fortinet's disclosure CISA added CVE-2026-104286 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. Fortinet has not attributed the activity, disclosed when it began, or stated how many organizations were affected. 

Fortinet's indicators point to attackers using file writes to establish persistence on the appliance. Review FortiMail systems for the following files, and compare them against the MD5 and SHA256 hashes:

The presence of /data/etc/ld.so.preload or /data/lib/liblog.so is a strong signal of compromise. A preloaded library can hide attacker processes, so a clean process listing on a suspect appliance should not be considered proof of a system being uncompromised. 

Fortinet also observed attackers creating a remote mail archive account (named "archive234" in the published sample) that sends archived mail to 79.141.169[.]187 under the /uploads directory.Review archive accounts in the GUI:

Email Archiving > Archive Account > Archive Account

Or with the CLI:

config archive account

For remote destinations or forwarding addresses your team did not configure, along with the archive policies that send mail to them. Search event logs and firewall records for connections involving 79.141.169[.]187 and 45.129.0[.]192, root cron entries referencing /migadmin, admin logouts recorded from a "(null)" interface, IBE decryption errors reporting invalid Base64 data, and admin CLI changes that your organization did not create. The paths listed below are what Fortinet identify as patterns of attack:

- type=event subtype=system pri=debug user=system ui=cron msg="(root) CMD (/bin/sh -c 'O=/migadmin ...
- type=kevent subtype=admin pri=information user=admin ui=(null) action=logout status=success reason=unknown msg="User admin logged out from (null)."
- type=kevent subtype=config pri=information user=admin ui=cli module=unknown submodule=unknown msg="Added 'archive234' to 'archive account' : rotation-size[50]rotation-time[1] rotation-hour[14]destination[remote]remote-ip[79.141.169.187]remote-username[archive234]remote-password[***]remote-directory[/uploads] (user: admin, from: cli)"
- FortiMail::IBE::DecrypterMediaIn::DecrypterMediaIn(FortiMail::MediaIn&, const FortiMail::IBE::KeyFinder&, const FortiMail::EmailAddress&, const FortiMail::Buffer&, FortiMail::IBE::DecrypterMediaIn::Version): Caught BufferException(2), BufferImpl.cpp:973, 'Invalid Base64 Encoding at pos 0. Character=0x2a'
- Internal user *@domain.tld<mailto:*@domain.tld> failed to log in.

Treat any appliance with a matching indicator as compromised. Fortinet has not published cleanup guidance; in that case, rebuild the appliance from known good firmware and rotate administrator passwords, archive server credentials, and any Microsoft 365 or Google Workspace credentials stored for API integration. 

Technical Details

Fortinet discovered the vulnerability internally, crediting Gwendal Guégniaud of its Product Security team, and has released limited technical details. The flaw combines a path traversal weakness with improper handling of NULL bytes in the FortiMail web interface. NULL byte flaws of this kind cause the software to treat input as ended before the input is actually terminated. That behavior enables traversal sequences to bypass validation, and attackers can then leverage the file system to write a file outside its intended directory. 

No authentication or user interaction is required, only network access to the FortiMail web interface. Fortinet lists the impact as execution of unauthorized code or commands, and the observed indicators show an added shared library registered for preloading, replaced system binaries, and a modified web server configuration. No working public proof-of-concept is known to be available at the time of writing. 

How Beazley Security is responding

Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found. 

We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients. 

If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team. 

Sources

• 

  https://nvd.nist.gov/vuln/detail/CVE-2026-104286 

• 

  https://fortiguard.fortinet.com/psirt/FG-IR-26-175 

• 

  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104286