Fortinet has disclosed a critical FortiMail vulnerability that is already being used in real-world attacks, creating an urgent response problem for organizations that expose email-security appliances to the internet. Tracked as CVE-2026-104286, the zero-day has a CVSS score of 9.8 and can allow an unauthenticated attacker to write files to an affected system by sending specially crafted HTTP or HTTPS requests.

The vendor published advisory FG-IR-26-175 on October 1. At the time of disclosure, fixed builds for several supported release branches were still described as forthcoming, so affected customers cannot safely wait for a routine maintenance window. Fortinet recommends disabling a vulnerable feature or removing the management interface from public reach while teams prepare upgrades and investigate whether exploitation has already occurred.

Why the flaw creates a serious appliance risk

CVE-2026-104286 combines path traversal with improper handling of null bytes. In practical terms, crafted paths can escape the directory where a request is supposed to operate, while the null-byte weakness can interfere with validation. Fortinet says that combination permits unauthorized file writes on the underlying appliance without requiring valid credentials.

Arbitrary file placement on a security gateway is more consequential than a conventional authentication error. Depending on where a file lands and how the appliance processes it, attackers may be able to establish persistence, alter services or stage additional malicious components. Fortinet has not publicly detailed the complete exploitation chain, attributed the operation or stated how many customers were compromised. The confirmed in-the-wild activity is nevertheless enough to justify emergency action.

Affected versions and immediate mitigation

The vulnerable ranges are FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9. Fortinet lists versions 8.0.2, 7.6.7 and 7.4.9 or later as the corrected releases for their respective branches. Customers on 7.2 are advised to move to 7.4 or newer, but they must choose an actually fixed build rather than assuming every 7.4 release is safe.

Until a suitable update is available, the vendor recommends disabling IBE support from the command line. Administrators can also block internet access to the FortiMail management interface or permit connections only from trusted private networks. Restricting exposure reduces the opportunity for new attacks, but it does not prove that a previously exposed appliance is clean.

• Inventory FortiMail systems and record their exact branch and build.
• Apply the IBE workaround or isolate the management interface immediately.
• Preserve system and configuration logs before making extensive changes.
• Upgrade to a fixed release as soon as the appropriate build is available.

Indicators that warrant investigation

Fortinet identified suspicious added files including /data/lib/liblog.so, /data/bin/webconsole, /data/bin/mailservice and /data/etc/ld.so.preload. It also highlighted modifications involving /bin/smit, /data/etc/httpd.conf and /data/migadmin.tar.gz. The advisory provides hashes that incident responders can use to validate artifacts rather than relying on filenames alone.

Network indicators include 79[.]141.169.187 and 45[.]129.0.192. One reported configuration entry created an archive account named archive234 and sent data to the first address under an uploads path. Other clues include root cron activity referencing /migadmin, unusual IBE decryption errors, failed internal-user logins and an administrator logout carrying a null interface value.

Containment must go beyond patching

Teams finding any match should treat it as a starting point for investigation, not automatic proof of compromise. They should correlate file integrity changes, outbound connections, accounts, scheduled tasks and configuration history. If intrusion is suspected, isolating the appliance and rebuilding from a trusted image may offer greater assurance than simply deleting visible artifacts.

The central lesson is that an emergency configuration change and a later software update solve only the exposure problem. Organizations also need to determine whether attackers reached the device before those controls were applied. The source report from Cyber Security News summarizes Fortinet’s affected versions, workaround and compromise indicators.