Critical Fortinet FortiMail 0-Day Vulnerability Actively Exploited

Fortinet has alerted customers to a critical zero-day vulnerability affecting its FortiMail email security gateways, identified as CVE-2026-104286. This flaw, carrying a severe CVSS score of 9.8, allows unauthenticated attackers to write arbitrary files to vulnerable devices by sending specially crafted HTTP or HTTPS requests. The vulnerability was publicly disclosed on October 1, 2026, via advisory FG-IR-26-175, with Fortinet urging immediate implementation of workarounds as patches are still pending for some affected versions.

The vulnerability stems from a combination of path traversal (CWE-22) and improper handling of NULL bytes (CWE-158). Attackers can leverage these weaknesses to bypass intended directory restrictions and write files directly onto the underlying system of the FortiMail appliance. This capability is particularly concerning as it does not require any form of authentication, meaning an attacker can compromise the integrity of the security device without needing prior access or credentials.

Fortinet has confirmed that the vulnerability is being actively exploited in the wild, emphasizing the urgency for organizations to mitigate the risk. While the full attack chain, specific threat actors, and the exact number of affected organizations have not been publicly detailed, the advisory stresses that administrators should not delay in applying mitigations. The discovery is credited to Gwendal Guégniaud of Fortinet's Product Security team.

The vulnerability impacts several versions of FortiMail, including releases 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9. Fortinet has indicated that fixes are forthcoming in versions 8.0.2, 7.6.7, and 7.4.9, or later releases. For users running the 7.2 branch, Fortinet recommends upgrading to version 7.4 or a later release. It is crucial for administrators to ensure they are deploying a fixed release, as not all versions within the listed branches are necessarily patched.

As immediate patches are not universally available, Fortinet recommends two primary workarounds. The first involves disabling the IBE (Inline Body Encryption) feature by executing specific commands in the command-line interface. The second recommended mitigation is to restrict or completely remove internet access to the FortiMail management interface, limiting access to trusted internal networks only.

Fortinet's advisory provides specific indicators of compromise (IOCs) that security teams should investigate. These include the presence of newly written files such as /data/lib/liblog.so, /data/bin/webconsole, /data/bin/mailservice, and /data/etc/ld.so.preload, as well as modifications to files like /bin/smit, /data/etc/httpd.conf, and /data/migadmin.tar.gz. The advisory also lists specific MD5 and SHA256 hashes for these files and points to suspicious IP addresses (79[.]141.169.187 and 45[.]129.0.192) and a suspicious archive account configuration. Other potential signs include root cron commands referencing /migadmin, unusual admin logouts, and IBE decryption errors.

While these IOCs are valuable, Fortinet advises assessing them collectively rather than in isolation. The company also notes that this vulnerability is distinct from a previously reported Fortinet zero-day (CVE-2025-32756) that affected other products like FortiVoice. Implementing the recommended workarounds is essential to reduce exposure, but organizations should also be prepared to investigate potential existing compromises by reviewing system logs, account changes, and network connections.

This incident underscores the ongoing threat posed by zero-day vulnerabilities in critical security infrastructure. By actively exploiting such flaws, attackers can gain a significant foothold, potentially disrupting email security and compromising sensitive communications. Prompt patching and diligent monitoring remain paramount for defending against these sophisticated threats.