Critical FortiMail Zero-Day CVE-2026-104286 Exploited in the Wild

An actively exploited zero-day vulnerability in Fortinet FortiMail secure email gateways allows unauthenticated attackers to write arbitrary files to underlying systems via crafted web requests. Tracked as CVE-2026-104286, the flaw carries a maximum CVSS v3.1 score of 9.8 and poses an immediate compromise risk to enterprise perimeters. Fortinet released a security advisory on October 1, 2026, confirming in-the-wild exploitation, while the Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalog the same day with a tight compliance deadline of October 4, 2026, for federal civilian agencies.

Because official patches for supported product branches have not yet been released, organizations relying on FortiMail appliances must act immediately to implement vendor-provided CLI workarounds or isolate device management interfaces.

Technical Breakdown of CVE-2026-104286

CVE-2026-104286 stems from a compound flaw combining path traversal (CWE-22) with improper neutralization of a NULL byte or NULL character (CWE-158). Discovered internally by Gwendal Guégniaud of Fortinet’s Product Security team, the vulnerability resides within the appliance’s web-based interface handling HTTP and HTTPS traffic.

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) highlights the severity of the design flaw. An attacker requires no privileges, no user interaction, and faces low attack complexity. By sending a specially crafted HTTP/HTTPS payload containing path traversal sequences (such as ../) coupled with NULL byte injection (%00), an attacker can truncate string validation checks in the web application while instructing the operating system to write arbitrary data outside the intended web directory.

In practical terms, an unauthenticated attacker can use this file write capability to drop web shells, overwrite critical configuration files, or insert execution scripts directly into system paths. Because web servers on security appliances often run with elevated or root permissions, an arbitrary file write on an appliance of this nature almost invariably translates into immediate remote code execution (RCE).

While the current Exploit Prediction Scoring System (EPSS) score sits at 1.8% (placing it in the 77.5th percentile), EPSS models typically lag behind zero-day disclosures where public proof-of-concept code has not yet been fully commercialized across mass scanning botnets. Given the verified in-the-wild exploitation, the real-world operational risk is far higher than the raw EPSS metric suggests.

Scope of Affected Systems and Blast Radius

Email gateways like FortiMail occupy a critical position in enterprise network architecture. Designed to filter incoming and outgoing mail, inspect attachments, and handle secure message delivery, these appliances sit directly on the network edge and are frequently exposed directly to the public internet.

The vulnerability impacts a wide range of FortiMail firmware releases:

• FortiMail 8.0 branch: Versions 8.0.0 through 8.0.1 are vulnerable (fix pending in 8.0.2).
• FortiMail 7.6 branch: Versions 7.6.0 through 7.6.6 are vulnerable (fix pending in 7.6.7).
• FortiMail 7.4 branch: Versions 7.4.0 through 7.4.8 are vulnerable (fix pending in 7.4.9).
• FortiMail 7.2 branch: Versions 7.2.0 through 7.2.9 are vulnerable. Fortinet has indicated no patch will be issued for the 7.2 release stream, requiring admins to upgrade to 7.4 or higher once patched builds land.

Compromise of an email security gateway provides threat actors with a high-value foothold. Beyond using the appliance as a pivot point into internal network segments, attackers who gain access to FortiMail can intercept sensitive corporate communications, manipulate email routing rules, harvest credentials, or drop malicious payloads into legitimate internal email flows to conduct internal spear-phishing.

Immediate Mitigation and Detection

Because fixed firmware versions (8.0.2, 7.6.7, and 7.4.9) remain unreleased, administrators must apply temporary operational mitigations immediately.

Fortinet has identified the Identity-Based Encryption (IBE) feature as the primary vector associated with this flaw. If your organization does not strictly require IBE, disable it via the FortiMail Command Line Interface (CLI) using the following configuration commands:

config system global
    set ibe-status disable
end

If disabling IBE is not feasible, administrators should immediately restrict administrative and web access to the appliance. Ensure the HTTP/HTTPS management interfaces are not exposed to the public internet, restricting access strictly to internal management VLANs or trusted administrative IP ranges via firewall access control lists (ACLs).

To hunt for potential compromise, security operations teams should review FortiMail web server logs for anomalous HTTP GET or POST requests containing URL-encoded NULL bytes (%00) or directory traversal strings (..%2f or ../). Fortinet has also published initial indicators of compromise—including specific file names, malicious IP addresses, and log entry patterns tied to observed threat activity—within its advisory (FG-IR-26-175). Organizations using FortiMail should cross-reference these indicators against their SIEM and network perimeter logs immediately.