FortiMail zero-day allows unauthenticated file writes in active attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a critical vulnerability in Fortinet FortiMail to its Known Exploited Vulnerabilities catalog on Thursday. This action follows confirmed reports that threat actors are actively exploiting the flaw, tracked as CVE-2026-104286, to compromise email infrastructure.

What happened

The vulnerability carries a CVSS score of 9.8, indicating maximum severity. It allows unauthenticated attackers to write arbitrary files to the underlying system by sending crafted HTTP or HTTPS requests. Fortinet confirmed that the bug has been exploited in the wild and credited Gwendal Guégniaud of its Product Security team for discovering and reporting the issue.

CISA’s inclusion of this flaw in the KEV catalog triggers mandatory remediation timelines for federal agencies. Federal Civilian Executive Branch (FCEB) agencies must apply patches or implement workarounds by October 4, 2026. This development occurs alongside active exploitation of vulnerabilities in products from Check Point, Arista, F5, Cisco, and Citrix, highlighting a broader trend of attacks against enterprise network appliances.

The flaw impacts several recent versions of FortiMail. Specifically, it affects FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9. Fortinet advises users on these versions to upgrade to upcoming releases such as 8.0.2, 7.6.7, or 7.4.9, or to move older branches up to 7.4 or above.

How it works

The root cause involves two specific weakness types: improper limitation of a pathname to a restricted directory, known as path traversal (CWE-22), and improper neutralization of NULL bytes or characters (CWE-158). Path traversal attacks occur when an application fails to properly sanitize user input, allowing an attacker to navigate outside the intended directory structure.

By injecting special characters like NULL bytes into HTTP requests, attackers can bypass security checks that normally restrict file access. This combination enables them to write files anywhere on the system where the application has permission. Since the attack requires no authentication, any actor with network access to the FortiMail interface can potentially execute the exploit.

Once the attacker writes arbitrary files, they can place malicious binaries or scripts on the server. Indicators of compromise include new files such as /data/lib/liblog.so and /data/bin/webconsole, as well as modifications to existing system files like /bin/smit and /data/etc/httpd.conf. These changes often facilitate persistent access or further lateral movement within the network.

Key details

• Vulnerability ID: CVE-2026-104286 with a CVSS score of 9.8.
• Attack vector: Unauthenticated remote attackers can write arbitrary files via crafted HTTP/HTTPS requests.
• Affected versions: FortiMail 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, and 7.2.0-7.2.9.
• Workarounds: Disable IBE feature support via CLI or restrict management interface access to trusted private networks.
• Indicators of compromise: Specific IP addresses 79.141.169[.]187 and 45.129.0[.]192, plus modified system files like /data/etc/ld.so.preload.
• Remediation deadline: FCEB agencies must patch or mitigate by October 4, 2026.

Why it matters

For engineering leads and security teams, this incident underscores the risk inherent in internet-facing management interfaces. Email gateways like FortiMail are critical infrastructure components, and a breach here can lead to full system compromise, data exfiltration, or use of the server as a pivot point for deeper network infiltration. The high CVSS score reflects the ease of exploitation and the severe impact of arbitrary file writes.

The simultaneous exploitation of vulnerabilities across multiple major vendors suggests a coordinated or opportunistic surge in attacks against enterprise edge devices. Teams managing hybrid or multi-vendor environments must prioritize patching not just for Fortinet, but for all listed appliances including Check Point and Cisco SD-WAN managers. Delaying updates leaves organizations exposed to known exploits that require minimal sophistication to execute.

What you can do

• Verify your current FortiMail version immediately and compare it against the affected ranges listed in the advisory.
• Apply the recommended workaround by disabling IBE feature support using the specified CLI command if patching is not yet possible.
• Restrict access to the FortiMail management interface so it is only reachable from trusted private networks, not the public internet.
• Scan your systems for the provided indicators of compromise, including the specific IP addresses and modified file paths.
• Plan upgrades to the fixed versions (8.0.2+, 7.6.7+, or 7.4.9+) as soon as they become available.
• Review other network appliances like Check Point, F5, and Citrix for similar active exploits and prioritize their patching cycles.