Fortinet has issued a warning about an actively exploited critical vulnerability in FortiMail, their email security solution. This zero-day flaw, identified as CVE-2026-104286, poses a significant risk to exposed systems by allowing unauthorized file writes through crafted HTTP or HTTPS requests, without needing login credentials.
Immediate Action Advised for Fortinet Customers
On October 1, 2026, Fortinet released advisory FG-IR-26-175, urging immediate implementation of workarounds. At the time of disclosure, security patches were still forthcoming for several affected versions, highlighting the urgency for organizations to act swiftly to safeguard their systems.
The vulnerability stems from two underlying issues: path traversal (CWE-22) and improper NULL byte handling (CWE-158). These weaknesses enable attackers to execute unauthorized file writes, which could compromise the integrity of the security appliance without requiring user credentials.
Understanding the Impact of the FortiMail Vulnerability
This vulnerability is more severe than typical login issues as it allows attackers to bypass authentication altogether. Although Fortinet has not detailed the complete attack chain or the extent of affected organizations, the exploitation of this flaw has been confirmed.
Discovered by Gwendal Guégniaud from Fortinet’s Product Security team, the issue remains without a virtual patch, prompting administrators to mitigate risks by following the provided guidance without delay.
Recommendations for Mitigating Risks
The affected FortiMail releases include versions 8.0.0 to 8.0.1, 7.6.0 to 7.6.6, 7.4.0 to 7.4.8, and 7.2.0 to 7.2.9. Fortinet plans to address these vulnerabilities in upcoming updates, specifically versions 8.0.2, 7.6.7, and 7.4.9, among others.
For users of FortiMail 7.2, the recommendation is to upgrade to at least version 7.4. Administrators should disable the IBE feature via the command-line interface or restrict management access to trusted networks as interim protections.
Detecting and Responding to Potential Breaches
Fortinet has identified several indicators for security teams to monitor, including specific file modifications and suspicious IP addresses. Notably, suspicious files and configurations, such as a rogue archive account, require thorough investigation to assess potential breaches.
Security teams should remain vigilant, checking for abnormal cron jobs or configuration discrepancies. Implementing the suggested workarounds and monitoring for unusual activity are crucial steps in protecting systems from this vulnerability.
Organizations must stay updated with Fortinet’s latest advisories and maintain rigorous log inspections to detect any anomalies. By limiting public management access and preserving critical logs, teams can better evaluate if their systems have been compromised.
