FortiMail CVE-2026-104286 Is Exploited, and Fortinet's Fixes Are 8.0.2, 7.6.7 and 7.4.9

An unauthenticated attacker with network access to the web interface of a FortiMail appliance running 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8 or 7.2.0 through 7.2.9 can write arbitrary files to the system, and Fortinet says the flaw, CVE-2026-104286, has been exploited in the wild. It is rated 9.8 out of 10 on the CVSS severity scale.

Fortinet published advisory FG-IR-26-175 on Oct. 1, and CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day, Help Net Security reported, giving federal civilian agencies until Oct. 4 to act. That is a three-day window.

What the advisory says an attacker needs

The weakness is a path traversal (CWE-22) combined with improper handling of NULL bytes (CWE-158) in the appliance's GUI component. The CVSS vector is AV:N/AC:L/PR:N/UI:N: network reachable, low complexity, no privileges, no user interaction. NVD's entry, written by Fortinet's PSIRT, says the attacker writes files "via crafted HTTP or HTTPS requests".

The advisory lists the impact as executing unauthorized code or commands, while the CVE text describes only file writes. A file write on an appliance can become code execution, but the advisory does not say how.

The 9.8 stands on the published vector. Fortinet's temporal score, which adjusts for the state of exploits and fixes, is 8.8. The workaround is to disable identity-based encryption (IBE) in the GUI under Encryption, IBE, IBE Service, or by CLI. Administrators who need IBE can restrict webmail access to trusted private networks or, behind a web application firewall, block POST requests to /ibe that contain ../.

Which versions get which fix

FortiMail branch	Affected	Fixed in
8.0	8.0.0 to 8.0.1	8.0.2
7.6	7.6.0 to 7.6.6	7.6.7
7.4	7.4.0 to 7.4.8	7.4.9
7.2	7.2.0 to 7.2.9	Move to the 7.4 branch or later

The advisory has three dated entries: initial publication Oct. 1, a solution update Oct. 5 and a FortiMail Cloud clarification Oct. 7. The Oct. 7 text says Fortinet's hosted FortiMail Cloud was remediated on Oct. 5 by moving to 7.6.7 GA or 8.0.2 GA, so cloud customers need do nothing. The page does not say in plain words that the on-premises builds can be downloaded. Help Net Security's Oct. 2 report said 8.0.2, 7.6.7 and 7.4.9 had not been released, and The Terminal did not find a later source confirming the date.

The photograph above shows a FortiGate firewall, not a FortiMail appliance; no freely licensed photograph of FortiMail hardware was found.

Where the reports disagree

Help Net Security's alternative mitigation is to block internet access to the management interface. The advisory's workaround talks about the webmail interface and the /ibe path, which is a different door. An operator who firewalled only the administration port has not necessarily closed it.

Fortinet did not share when or where the attacks were seen, how many systems were compromised or who was behind them, according to Help Net Security. It did publish files, IP addresses and log entries tied to the attacks so administrators can check their own appliances. The flaw was found internally and reported by Gwendal Guégniaud of Fortinet's Product Security team, per the advisory.

Edge appliances that sit in front of mail are the same class of target as the Cisco, Veeam and SonicWall devices in SafePay's advisory, though those five CVEs were all two years old or more and this one is 23 days old. The PHP case is the other extreme: an unpatched RCE with three preconditions.

Operators on 7.2.x have no in-branch fix and must upgrade the branch. Anyone on 8.0, 7.6 or 7.4 should confirm in the Fortinet support portal that 8.0.2, 7.6.7 or 7.4.9 is available for their model before the IBE workaround is lifted.