Fortinet Warns of Critical FortiMail Zero-Day Exploited in Code Execution Attacks

Active zero-day exploitation is underway targeting a critical Fortinet FortiMail vulnerability tracked as CVE-2026-104286. The flaw, which carries a maximum-severity CVSS score of 9.8, enables unauthenticated remote attackers to write arbitrary files onto underlying appliance filesystems via specially crafted HTTP or HTTPS requests directed at the FortiMail management interface. Fortinet and government cybersecurity partners, including CISA, have confirmed in-the-wild exploitation, prompting CISA to add the vulnerability to its Known Exploited Vulnerabilities catalog with a tight compliance deadline for federal agencies.

Technical Analysis of CVE-2026-104286

The vulnerability (tracked internally by Fortinet as FG-IR-26-175) stems from a combination of path traversal (CWE-22) and improper neutralization of NULL bytes (CWE-158). In web application security, path traversal sequences like ../ allow an attacker to escape designated directory bounds. When combined with NULL byte injection (%00), attackers can bypass file-extension validation checks in underlying C-based string handling routines, causing the system to truncate file paths at the NULL character.

By exploiting this flaw against the web management interface, an unauthenticated attacker can force the system to write arbitrary files to restricted locations on the disk. Once an attacker writes executable scripts, web shells, or modified configuration files to the underlying operating system, they effectively gain arbitrary code and command execution capabilities with administrative privileges.

The measured CVSS v3.1 score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the minimal barrier to exploitation:

• Attack Vector (AV:N): Reachable remotely over the network via HTTP/HTTPS management interfaces.
• Attack Complexity (AC:L): Requires no special conditions or complex timing.
• Privileges Required (PR:N): Bypasses administrative authentication entirely.
• User Interaction (UI:N): Triggers automatically without requiring administrator or user action.
• Impact (C:H/I:H/A:H): Complete loss of system confidentiality, integrity, and availability.

Affected Versions and Patch Availability

Discovered internally by Gwendal Guégniaud of Fortinet’s Product Security team, the flaw impacts four primary release branches of FortiMail:

• FortiMail 8.0 branch: Versions 8.0.0 through 8.0.1
• FortiMail 7.6 branch: Versions 7.6.0 through 7.6.6
• FortiMail 7.4 branch: Versions 7.4.0 through 7.4.8
• FortiMail 7.2 branch: Versions 7.2.0 through 7.2.9

Security updates are currently not available for the 7.4, 7.6, and 8.0 branches. Fortinet has slated fixes for upcoming maintenance releases FortiMail 7.4.9, FortiMail 7.6.7, and FortiMail 8.0.2. For organizations running FortiMail 7.2, Fortinet recommends upgrading directly to the 7.4 release branch or later to apply available protection.

Realistic Blast Radius and Threat Impact

Secure email gateways sit at the perimeter of enterprise networks, processing inbound and outbound corporate communications, managing email archives, and handling sensitive user directory metadata. Gaining root-level code execution on a FortiMail appliance allows threat actors to intercept enterprise communications, steal credentials, and pivot deeper into internal networks.

In observed real-world exploitation, attackers utilized their foothold to modify mail archiving mechanisms. Forensic evidence indicates that threat actors executed command-line directives to create an archive account named archive234, pointing remote archive storage to IP address 79.141.169.187 with the remote path /uploads. This behavior suggests that adversaries are abusing administrative features to systematically exfiltrate archived corporate email records to actor-controlled infrastructure. Attackers also established persistence on compromised appliances by executing cron jobs targeting /migadmin.

Indicators of Compromise & Forensic Detection

Security operations teams deploying FortiMail appliances should review logs, firewall rules, and host integrity immediately. Identified threat actor infrastructure and telemetry signatures include:

• Known Malicious IP Addresses:

  • 79.141.169.187
  • 45.129.0.192

• Key Forensic Telemetry to Audit:

  • Command-line configurations establishing unauthorized remote archive destinations (e.g., account archive234 routing to /uploads).
  • Cron job executions referencing /migadmin or unexplained scheduled tasks.
  • System log entries recording Identity-Based Encryption (IBE) decryption errors caused by malformed Base64 string formatting (indicative of initial exploit attempts).
  • Administrative logout events and failed login attempts occurring in close sequence with abnormal HTTP/HTTPS requests.
  • Unexpected file creation or modification on the local appliance filesystem.

Mitigation and Workarounds

Because official updates remain pending for several affected branches, administrators must immediately apply workaround steps to block remote attack vectors:

1. Disable IBE Feature Support: Disable Identity-Based Encryption (IBE) feature support through the FortiMail CLI interface to eliminate the vulnerable request processing logic.
2. Restrict Management Interface Access: Ensure the FortiMail web management interface is strictly isolated from the public internet. Restrict administrative access on HTTP/HTTPS ports to trusted internal management networks or isolated administrative VPNs.
3. Perform Forensic Triage: Federal agencies must conduct thorough forensic audits and apply mitigations by October 4th in accordance with CISA directives. Private sector entities should conduct equivalent forensic log analysis prior to applying workarounds to confirm whether compromise occurred prior to containment.