FortiMail Zero-Day CVE-2026-104286: Apply FG-IR-26-175 Before October 4 Deadline

CVE-2026-104286 is a path traversal vulnerability in the FortiMail web management interface, specifically in request handling code associated with the Identity-Based Encryption feature. Path traversal vulnerabilities exist when an application constructs a filesystem path from user-supplied input without adequately restricting the traversal above a defined base directory.

FortiMail's vulnerable endpoint accepts an HTTP or HTTPS request that encodes directory traversal sequences using URL encoding (/../ as %2e%2e%2f) combined with null-byte insertion (%00) at specific positions. The null byte terminates the path string in the server's underlying C runtime, causing validation logic that checks the suffix of the path to see a safe extension while the actual write target resolves to an arbitrary filesystem location above the intended base directory.

An attacker sends a crafted POST request to the management interface -- no authentication token, session cookie, or valid credentials required. The payload specifies arbitrary file content and a traversal sequence that places the written file wherever the attacker chooses on the filesystem. The CVSS v3.1 score of 9.8 reflects the combination of network reachability, no authentication required, no user interaction, and high impact across all three dimensions of confidentiality, integrity, and availability.

The attack completes in a single request. The round-trip from initial contact to confirmed file write is under one second on a reachable appliance. Follow-on payloads -- library preload modifications, webshell installation, service binary replacement -- execute in subsequent requests. The entire sequence from unauthenticated access to persistent root-level code execution takes under two minutes on a default FortiMail configuration.

The IBE feature is enabled by default in many enterprise FortiMail deployments, meaning the attack surface is present without any additional configuration by the administrator.

Every currently supported FortiMail version line is affected. The full scope confirmed in Fortinet's FG-IR-26-175 advisory covers four major branches.

FortiMail 7.2.x: versions 7.2.0 through 7.2.9 are vulnerable. The pending fixed release is 7.2.10.

FortiMail 7.4.x: versions 7.4.0 through 7.4.8 are vulnerable. The pending fixed release is 7.4.9.

FortiMail 7.6.x: versions 7.6.0 through 7.6.6 are vulnerable. The pending fixed release is 7.6.7.

FortiMail 8.0.x: versions 8.0.0 and 8.0.1 are vulnerable. The pending fixed release is 8.0.2.

Fortinet has not listed any EOL releases as safe -- the vulnerability is a design flaw in the path handling library shared across branches, so older unsupported versions should be assumed vulnerable as well.

The attack surface depends on how the management interface is exposed. Organizations that have restricted management interface access to internal IP addresses have significantly reduced their risk, even if they have not applied the full workaround. Organizations that expose the management interface to any external IP address are immediately and actively targeted.

Verify your running firmware version in the FortiMail admin console under System > Dashboard > Status. If the displayed firmware version falls within any of the four affected ranges, treat the appliance as potentially compromised until both FG-IR-26-175 workarounds are in place and a forensic check confirms no intrusion indicators are present.

A critical deployment risk: some FortiMail configurations expose the management interface on the same IP address and port used for inbound mail delivery (TCP 25 and 443 can share an IP). In these cases, restricting management access at the perimeter requires careful ACL construction to avoid blocking legitimate mail flow.

Observed post-exploitation activity confirms that attackers are using the arbitrary file write capability to establish persistent root-level access on compromised FortiMail appliances.

The highest-confidence persistence mechanism is modification of /data/etc/ld.so.preload. The Linux dynamic linker reads this file at process startup and loads the listed shared objects before any other library. An attacker who writes a malicious shared library path to ld.so.preload ensures that attacker-controlled code executes in the context of every process that starts on the system after the modification, including privileged Fortinet services. Detecting this indicator is straightforward -- the file should not exist on a clean FortiMail installation.

A second persistence path observed in the wild is the replacement of /data/lib/liblog.so with a trojanized version. The modified library hooks Fortinet's logging subsystem, giving attackers visibility into authentication events and the ability to suppress or forge log entries to obscure activity. The modification timestamp on this file will be inconsistent with other library files installed during the same firmware build.

Attackers also drop standalone binaries: a webshell at /data/bin/webconsole provides an interactive command channel, while a malicious binary at /bin/smit and a modified /data/bin/mailservice provide additional persistence if earlier payloads are detected and removed.

Command-and-control traffic establishes outbound sessions to 79.141.169.187 and 45.129.0.192 over TCP 443. These IPs have no legitimate relationship to FortiMail management traffic. Any established TCP session from a FortiMail appliance to either IP should be treated as confirmation of compromise.

The FortiMail compromise also enables inbound threat delivery. An attacker who controls the mail security appliance can selectively allow malicious emails to bypass scanning, creating a secondary entry point into the organization for phishing and malware delivery campaigns.

These rules detect CVE-2026-104286 exploitation attempts via path traversal in FortiMail HTTP logs and post-exploitation persistence via ld.so.preload modification on the appliance filesystem. Both carry experimental status; validate against your FortiMail log source format and auditd configuration before enabling automatic blocking.

Fortinet's FG-IR-26-175 advisory provides two mitigations that must both be applied before the patch ships.

FortiMail CVE-2026-104286 is particularly dangerous because email security gateways sit at a uniquely privileged position in enterprise architecture. They process every inbound and outbound message, maintain archives of organizational communications, authenticate against Active Directory or LDAP for policy enforcement, and hold TLS certificates for mail encryption. A compromised gateway gives attackers more than a foothold -- it gives them a surveillance position over all organizational mail traffic and the ability to selectively disable the security controls that employees depend on.

The no-patch status amplifies the risk in a way that a standard KEV patch advisory does not. When CISA adds a CVE to the KEV catalog and a patch exists, the response is straightforward: patch within the deadline. When no patch exists, defenders must operate on workarounds indefinitely while the exploitation window remains open. Attackers know this. Threat actors actively monitor CISA KEV additions for entries marked as workaround-only, because those represent the longest viable exploitation windows.

For related analysis of perimeter appliance zero-days that share this attack pattern, see our coverage of the FortiGate CVE-2025-25249 PivotC2 RAT exploitation and the Check Point CVE-2026-85102 security gateway RCE. Both followed the same pattern: unauthenticated access to a perimeter appliance, rapid post-exploitation, and extended dwell time before organizational detection.

Organizations running FortiMail should escalate this to a P1 incident response action today. Apply both FG-IR-26-175 workarounds, run the full forensic checklist, block the confirmed C2 IPs, and deploy the Sigma detection rules in this advisory against your SIEM. Do not wait for the patch before hunting -- attackers began exploiting this flaw before Fortinet published the advisory.