Fortinet disclosed on October 1, 2026 that attackers are exploiting a critical flaw in FortiMail, its email security gateway, which lets someone with no credentials write arbitrary files to the appliance using crafted HTTP or HTTPS requests. The FortiMail zero-day is tracked as CVE-2026-104286 and carries a CVSS 3 score of 9.8.
Four release branches are affected, from 7.2 through 8.0. Reports published on October 2 said the fixed builds had not yet been released, so for most owners the workaround is the first job, not the patch.
| What happened | Unauthenticated arbitrary file write in FortiMail through crafted HTTP/HTTPS requests, exploited as a zero-day |
| Who’s affected | FortiMail 7.2.0 to 7.2.9, 7.4.0 to 7.4.8, 7.6.0 to 7.6.6, and 8.0.0 to 8.0.1 |
| Severity | Critical: CVSS 3 base score 9.8 |
| Status | Exploited in the wild; added to CISA’s Known Exploited Vulnerabilities catalog on October 1, 2026; fixes named as 7.4.9, 7.6.7 and 8.0.2 |
| What to do now | Restrict the management interface to trusted networks or disable IBE, then check Fortinet’s indicators of compromise |
What happened
Fortinet’s product security team published advisory FG-IR-26-175 on October 1. The bug combines a path traversal weakness (CWE-22) with improper handling of null bytes (CWE-158), and Fortinet states that it has been exploited in attacks.
According to Help Net Security, Fortinet researcher Gwendal Guégniaud found the issue internally. Fortinet has not disclosed who is behind the attacks, how many organizations were hit, or where they are.
The same day, CISA listed the flaw in its KEV catalog of vulnerabilities known to be exploited, giving US federal agencies until October 4 to fix it, watchTowr reports.
How the FortiMail zero-day works
The vulnerable code is reached through FortiMail’s web interface; Field Effect places it in a web endpoint that handles IBE requests. A crafted request lets an unauthenticated attacker place files outside the directories the application is supposed to write to. In its analysis of the flaw, watchTowr explains that this kind of file write can be turned into command execution and full control of the device, and that appliances with an internet-facing management interface are directly reachable.
Fortinet’s workaround points to the Identity-Based Encryption (IBE) feature as part of the exposed path. Its indicators of compromise describe what an intrusion leaves behind: added or modified system files including liblog.so, httpd.conf and ld.so.preload, cron commands referencing /migadmin, admin logouts followed by configuration changes, archive accounts with remote credentials pointing to suspicious IPs, IBE decryption failures showing invalid Base64 errors, failed authentication for wildcard accounts, and traffic involving 79.141.169.187 and 45.129.0.192. The advisory also lists file hashes. BleepingComputer reports that an archive account named archive234 was set up to exfiltrate data.
That ld.so.preload entry deserves attention. On Linux, the file lists libraries that load into every dynamically linked program on the system, so an unexpected change there is a strong sign that someone has planted code meant to survive.
Why it matters for small businesses
FortiMail filters a company’s email, so whoever controls the appliance sits on one of the most sensitive data flows in the business. If an IT provider manages your email security, you may not know whether FortiMail is part of the setup or whether its admin page faces the internet. Ask today.
The October 4 deadline legally binds only US federal civilian agencies. CISA adds flaws to that catalog because they are being used in real attacks, though, so private companies in the US, UK, EU, Pakistan and elsewhere should read the listing as a signal of active risk.
What to do now
- Confirm whether your business, or your IT provider on your behalf, runs FortiMail, and on which version.
- If you suspect the appliance was already compromised, preserve logs, configuration backups and forensic images before you change anything, as watchTowr advises.
- If the management interface can be reached from the internet, restrict it to trusted internal networks today. This is one of the two workarounds in Fortinet’s advisory.
- If you cannot restrict access, disable IBE using the GUI or CLI steps in the advisory. If you use IBE to send encrypted mail to customers, plan for that feature being unavailable until you upgrade.
- Check the appliance against the full indicator list in Fortinet’s advisory, including all seven file paths and their hashes, the log patterns described above, and the two IP addresses. Do not rely on a summary, including ours.
- Install 7.4.9, 7.6.7 or 8.0.2 as soon as Fortinet makes them available. Systems on 7.2 need to move to the 7.4 branch or later, because Fortinet lists no fix within 7.2.
- If you find signs of compromise, treat the device as untrusted. watchTowr recommends rotating administrative credentials and reviewing accounts after remediation. We also recommend putting every admin login behind multi-factor authentication; our guide to MFA tools for small merchants covers practical options.
Oreaxe’s take
Email gateways attract attackers for a simple reason: they are exposed to the internet by design, and everything behind them trusts them. The software fix for this bug will arrive, but the condition that turns it into a crisis is a web interface, whether the admin panel or the IBE service, that anyone online can reach.
Our view is that the management interface of a security appliance should never face the public internet, whichever vendor made it, and any feature that must face the internet deserves its own review. If yours does, this incident is the reason to change that, whether or not you are patched by next week.
For small teams, the deeper lesson is inventory. You cannot act on an advisory for a box you did not know you had. A one-page list of every internet-facing device and who manages it is the cheapest control in security, and it belongs in the basic plan we outline in 7 cyber threats every small business should plan for.
Sources
- Fortinet PSIRT: FG-IR-26-175, FortiMail path traversal (October 1, 2026)
- BleepingComputer: Fortinet warns of critical FortiMail flaw exploited in zero-day attacks (October 1, 2026)
- watchTowr: Fortinet FortiMail FAQ, CVE-2026-104286 (October 1, 2026)
- Help Net Security: Critical FortiMail zero-day exploited in the wild (October 2, 2026)
- Field Effect: Patches pending for actively exploited FortiMail flaw (October 2, 2026)
Every factual claim links to its source. Spotted an error? Tell us.