Fortinet FortiMail administrators need to pay immediate attention to CVE-2026-104286, a critical vulnerability that is already being exploited in the wild.
The vulnerability affects the FortiMail management functionality and can allow an unauthenticated remote attacker to write arbitrary files to the underlying system through specially crafted HTTP or HTTPS requests.
The vulnerability has been assigned a CVSS v3.1 score of 9.8, making it a critical-severity issue. It has also been added to the CISA Known Exploited Vulnerabilities (KEV) catalog following reports of active exploitation.
For organizations running FortiMail at the network perimeter, this should be treated as a high-priority security incident, rather than a routine vulnerability update.
Table of Contents
What is CVE-2026-104286?
CVE-2026-104286 is a vulnerability in Fortinet FortiMail involving two security weaknesses:
- CWE-22 — Path Traversal
- CWE-158 — Improper Neutralization of NULL Byte or NULL Character
An attacker can exploit the vulnerable functionality by sending specially crafted HTTP or HTTPS requests to the FortiMail appliance.
Importantly, authentication is not required for exploitation.
Successful exploitation can allow an attacker to modify or create arbitrary files on the underlying FortiMail system. Security authorities have warned that this capability can potentially lead to unauthorized code execution and further compromise of the appliance.
Why is this FortiMail vulnerability so serious?
FortiMail is normally deployed as an email security gateway, often positioned at or close to the organization’s network perimeter.
It can inspect and process:
- Incoming email
- Outgoing email
- Spam
- Phishing attempts
- Malware
- Email attachments
- Email security policies
- Encryption-related functions
Therefore, compromising an email-security appliance can have consequences beyond simply taking down one device.
An attacker who gains unauthorized control over a security appliance could potentially use it for persistence, configuration manipulation, malicious file placement or further intrusion into the organization’s infrastructure.
However, organizations should avoid assuming that every vulnerable FortiMail has been fully compromised. Active exploitation of the vulnerability has been confirmed, but the presence and impact of compromise must be determined through investigation.
CVE-2026-104286: Affected FortiMail Versions
According to the published vulnerability information, the following FortiMail versions are affected:
| FortiMail Branch | Affected Versions |
|---|---|
| FortiMail 8.0 | 8.0.0 – 8.0.1 |
| FortiMail 7.6 | 7.6.0 – 7.6.6 |
| FortiMail 7.4 | 7.4.0 – 7.4.8 |
| FortiMail 7.2 | 7.2.0 – 7.2.9 |
These version ranges are also reflected in CERT-In’s advisory for the vulnerability.
What about FortiMail 7.0?
Some third-party vulnerability databases contain additional 7.0.x references, but the primary affected-version information currently being cited for this FortiMail advisory covers the 7.2, 7.4, 7.6 and 8.0 branches.
Administrators should therefore verify their exact FortiMail version against Fortinet’s current PSIRT advisory rather than assuming that a particular branch is safe.
Is CVE-2026-104286 being actively exploited?
Yes.
Fortinet reported exploitation of the vulnerability in the wild.
CISA subsequently added CVE-2026-104286 to its Known Exploited Vulnerabilities catalog, indicating that exploitation is not merely theoretical.
This changes the priority for security teams.
A vulnerability that is merely disclosed can normally be handled through scheduled vulnerability-management processes.
An actively exploited, unauthenticated, internet-facing vulnerability with a CVSS score of 9.8 should instead be treated as an urgent security issue.
How does the attack work?
At a high level, the vulnerability involves improper handling of file paths and NULL characters.
The vulnerable functionality can be abused through specially crafted HTTP or HTTPS requests.
The attacker does not need to authenticate first.
The successful attack can provide the ability to write files outside their intended location on the FortiMail underlying system.
The important security chain is therefore:
Remote attacker → crafted web request → vulnerable FortiMail functionality → arbitrary file write → potential system compromise
Fortinet and CERT-In describe the vulnerability as involving path traversal and NULL-byte handling. CERT-In also warns that successful exploitation could allow modification of system files and arbitrary code execution.
Immediate Mitigation for FortiMail Administrators
If you are running an affected FortiMail version, do not wait for a routine maintenance window before applying the available mitigation.
Fortinet’s published workaround is to disable the Identity-Based Encryption (IBE) feature support.
Use:
config system encryption ibe
set status disable
endCERT-In also recommends disabling access to the FortiMail management interface from the internet, or restricting it to trusted private networks.
Important
Disabling IBE may affect organizations that actively use FortiMail Identity-Based Encryption.
Before applying the change in production, security and messaging teams should confirm whether IBE is required.
The alternative—or additional defense—is to ensure that the FortiMail management interface is not publicly reachable.
Restrict FortiMail Management Access
A strong network-security practice is to keep administrative interfaces away from the public internet.
Ideally:
Internet
|
| SMTP / Required Services
|
FortiMail
|
+---- Management Interface
|
+---- Trusted Admin VLAN
|
+---- Jump Server
|
+---- VPNInstead of:
Internet
|
+---- FortiMail Management GUIThe management interface should preferably be reachable only through:
- Internal management VLAN
- VPN
- Bastion/jump server
- Trusted administrator network
- Explicitly permitted management IP addresses
CERT-In specifically recommends restricting FortiMail management access to trusted private networks as an alternative mitigation.
What versions contain the fix?
At the time of the initial advisory, Fortinet listed fixed releases for the affected branches as upcoming releases.
The advisory information cited the following target versions:
| Branch | Fixed release referenced by Fortinet |
|---|---|
| 8.0 | 8.0.2 or later |
| 7.6 | 7.6.7 or later |
| 7.4 | 7.4.9 or later |
| 7.2 | Migration to a later supported branch |
Administrators should check the live Fortinet PSIRT advisory before upgrading, because release availability can change after an advisory is published. The versions above should not be assumed to be downloadable merely because they are listed as future fixes in the original advisory.
Important note for FortiMail 7.2
Do not blindly upgrade a FortiMail 7.2 system to an arbitrary 7.4.x release.
The affected range includes FortiMail 7.4.0 through 7.4.8, so an upgrade that lands on another vulnerable build does not resolve the vulnerability.
Always verify the destination build against the latest Fortinet advisory before performing the upgrade.
How to Check Your FortiMail Version
Before making any change, identify the exact software version running on the appliance.
From the CLI, administrators can use:
get system statusLook for the FortiMail version/build information.
For example, you may see a version corresponding to:
7.4.x
7.6.x
8.0.xThe exact build number matters.
Do not simply check the major branch.
For example:
7.4.x does not automatically mean safe.
FortiMail 7.4.0 through 7.4.8 are within the affected range.
How to Check Whether IBE Was Disabled
After applying the workaround, administrators should verify the configuration.
config system encryption ibe
get
endThe IBE status should reflect the disabled state after the mitigation is applied.
Always verify the resulting configuration and monitor the appliance after making security changes.
Do Not Forget Incident Investigation
Because CVE-2026-104286 is already being exploited, simply applying a workaround or patch should not automatically be considered proof that the appliance was never compromised.
Security teams should investigate vulnerable appliances that were exposed before mitigation.
At minimum, review:
- FortiMail system logs
- Administrative activity
- Authentication events
- Web/HTTP activity
- Configuration changes
- Unexpected files
- Unexpected processes
- Network connections
- DNS activity
- Outbound connections
- Recent software/configuration changes
- SIEM alerts
If the appliance was directly exposed to the internet and was running a vulnerable version, consider performing a deeper forensic review.
What Should Network Administrators Do Today?
A practical response checklist is:
1. Identify all FortiMail appliances
Create an inventory containing:
Hostname
IP Address
FortiMail Model
FortiMail Version
Internet Exposure
IBE Status
Management Access
Last Backup2. Check the exact software version
Run:
get system statusCompare the result against the affected versions.
3. Remove unnecessary internet exposure
Restrict FortiMail management access to trusted networks.
4. Apply the IBE mitigation if appropriate
config system encryption ibe
set status disable
end5. Monitor the appliance
Look for suspicious file, configuration and network activity.
6. Check Fortinet’s current PSIRT advisory
Do not rely solely on an old vulnerability article. Confirm the current fixed build and supported upgrade path before upgrading.
7. Patch as soon as the appropriate fixed release is available
After upgrading:
get system statusVerify that the expected build is actually installed.
Does this affect FortiGate?
No — this is a FortiMail vulnerability, not a FortiGate vulnerability.
CVE-2026-104286 specifically concerns Fortinet FortiMail.
Organizations that operate FortiGate firewalls but do not use FortiMail are not affected by this particular vulnerability.
However, organizations running both FortiGate and FortiMail should independently review the security status of both platforms because they perform different roles in the network.
Why This Matters for Enterprise Networks
Security appliances are often considered trusted infrastructure.
That makes vulnerabilities in these devices particularly important.
A compromised endpoint is one thing.
A compromised security gateway can be much more significant because it may sit directly in the path of enterprise traffic and have privileged access to network services.
This is why organizations should follow a simple principle:
Never assume a security appliance is safe simply because it is a security appliance.
Firewalls, VPN gateways, email gateways, load balancers and network-management systems all require the same vulnerability-management discipline as servers and endpoints.
Final Recommendations
CVE-2026-104286 deserves immediate attention from organizations running FortiMail.
The combination of:
- CVSS 9.8
- Unauthenticated exploitation
- Remote attack capability
- Arbitrary file-write capability
- Internet-facing security appliance
- Confirmed exploitation in the wild
- CISA KEV listing
makes this a high-priority vulnerability for affected environments.
FortiMail administrators should:
Identify → Restrict → Mitigate → Investigate → Patch → Verify
Do not wait for evidence of compromise before taking action.
If your FortiMail appliance is running an affected version, apply the available mitigation, restrict management access, investigate for signs of compromise and move to the appropriate fixed release as soon as it is available and verified.
References
- Fortinet PSIRT — FG-IR-26-175
- CISA Known Exploited Vulnerabilities Catalog
- CERT-In Vulnerability Note — CIVN-2026-0487
- CVE-2026-104286
Disclaimer: This article is provided for security awareness and defensive administration. Always verify the latest Fortinet advisory and release notes before making production changes.