Vulnerabilities

Fortinet warns of critical CVE-2026-104286 FortiMail flaw exploited in zero-day attacks

October 2, 2026 00:00 · 9 min read
Fortinet warns of critical CVE-2026-104286 FortiMail flaw exploited in zero-day attacks

Fortinet Issues Urgent Warning on Actively Exploited FortiMail Zero-Day Flaw

Fortinet has issued a security advisory warning customers about a critical vulnerability in its FortiMail email security appliance that is currently being exploited in zero-day attacks. The flaw, identified as CVE-2026-104286, allows unauthenticated attackers to execute arbitrary code or commands on affected systems by sending specially crafted HTTP or HTTPS requests to the FortiMail management interface.

The vulnerability carries a CVSS score of 9.8, reflecting its critical severity due to the combination of two weaknesses: an improper limitation of a pathname to a restricted directory (CWE-22, path traversal) and improper neutralization of NULL bytes or characters (CWE-158). Together, these flaws enable file system manipulation that can lead to full system compromise.

Discovery and Affected Versions

CVE-2026-104286 was discovered internally by Gwendal Guégniaud of Fortinet's Product Security team. The vulnerability impacts multiple versions of FortiMail across several release branches:

Fortinet confirms that active exploitation is occurring in the wild and urges administrators to apply mitigations immediately while waiting for official patches.

Patch Availability and Workarounds

For users running FortiMail 7.2, Fortinet recommends upgrading to the 7.4 branch or later to receive protection. However, for those on FortiMail 7.4, 7.6, and 8.0, security updates are not yet available. Fortinet has identified the following upcoming versions that will include the fix:

Until these versions are released, Fortinet provides two primary workarounds. Administrators can disable the Identity-Based Encryption (IBE) feature via the CLI using:

config system encryption ibe
set status disable
end

As an alternative, access to the FortiMail management interface should be restricted from the Internet and limited to trusted private networks only.

Indicators of Compromise and Forensic Evidence

Fortinet has published specific indicators of compromise (IOCs) to help organizations detect potential breaches. These include several files that were added or modified on compromised systems:

Additionally, the following IP addresses have been linked to the attacks: 79.141.169.187 and 45.129.0.192.

Fortinet also shared log entries that may indicate compromise. One notable entry shows the configuration of an archive account named 'archive234' pointing to the remote server 79.141.169.187 and directory '/uploads', suggesting data exfiltration. Other suspicious activities include cron jobs executing commands related to /migadmin, administrator logout events, IBE decryption errors due to invalid Base64 encoding, and failed login attempts.

CISA Involvement and Federal Guidance

When contacted by BleepingComputer, Fortinet confirmed it is coordinating with government agencies, including the Cybersecurity and Infrastructure Security Agency (CISA), on the advisory. CISA has since added CVE-2026-104286 to its Known Exploited Vulnerabilities catalog, requiring federal agencies to perform forensic triage and apply mitigations by October 4, 2026.

Fortinet emphasized its commitment to responsible disclosure, stating: "Consistent with Fortinet’s commitment to responsible PSIRT disclosure and public-private partnerships, we are communicating with relevant government organizations, including CISA, on the content of this advisory."

As of the advisory's release, Fortinet has not disclosed the initial exploitation date, the number of compromised systems, or the identity of the threat actors behind the attacks.

Source: BleepingComputer

Source: BleepingComputer

Powered by ZeroBot

Protect your website from bots, scrapers, and automated threats.

Try ZeroBot Free

Related Articles