Fortinet tells FortiMail admins to disable IBE while an exploited CVSS 9.8 flaw awaits fixes
Fortinet says attackers are exploiting a CVSS 9.8 unauthenticated file-write flaw in FortiMail, and no fixed release has shipped yet. Until builds arrive, its two workarounds are the only protection, including for 7.2 users told to move to a 7.4 branch that is still unpatched.
The Watch · Security desk
What happened
- BleepingComputer reports the bug is in the FortiMail management interface and is being used to run unauthorized code or commands on vulnerable devices.
- Fortinet published its advisory on October 1, 2026, and CISA added the flaw to its KEV catalog the same day, giving federal civilian agencies until October 4.
- Fixes are due in FortiMail 7.4.9, 7.6.7 and 8.0.2, none of them released yet, and Fortinet tells 7.2 users to move to the 7.4 branch or above.
- Until then, Fortinet says admins can disable IBE from the CLI, or block internet access to the management interface and allow only trusted private networks.
- Fortinet published indicators of compromise, including two attacker IP addresses, lists of added and modified files, and log entries for checking appliances.
Why it matters
- Who has to decide decision FortiMail 7.2 operators have two jobs at once: apply a workaround now, and plan a branch migration that will not remove the flaw until 7.4.9 or a later fixed build exists.
- What it costs cost Customers who turn IBE off lose identity-based encryption until a fix ships. The other workaround, keeping the management interface off the internet, leaves IBE running.
- Who's exposed exposure Appliances that were reachable before a workaround went in may already have the added files or an attacker's archive account, and CISA's order requires federal agencies to do forensic triage as well as mitigation.
Next story · Security · 2d ago
Exploited Cisco email gateway flaw lets a crafted attachment run commands as rootConfirmed5 publishers
Fortinet classes the 9.8-rated bug as a path traversal combined with improper handling of NULL bytes [2]. It said the flaw "may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests" [3]. Fortinet found it internally and credited Gwendal Guégniaud of its Product Security team [14].
The version table makes the 7.2 advice harder to follow. Every build from 7.2.0 through 7.2.9 is affected, and Fortinet's only route out is the 7.4 branch or above [6]. A 7.2 appliance moved to 7.4 today lands on 7.4.8 or earlier, which is still inside the affected range [19]. The same goes for 7.6 and 8.0 [18]. BleepingComputer wrote that 7.2 users "can patch the vulnerability by upgrading to the 7.4 branch or later" [13]. Going by Fortinet's own version numbers, that is only true once 7.4.9, 7.6.7 or 8.0.2 ships [18].
Fortinet's sample log entries include an IBE decryption error caused by invalid Base64 encoding [12]. IBE, FortiMail's identity-based encryption feature, is what the first workaround turns off [8][9].
The file indicators show what attackers leave on a box. Four files are added: `/data/lib/liblog.so`, `/data/bin/webconsole`, `/data/bin/mailservice` and `/data/etc/ld.so.preload` [11]. Three are modified: `/bin/smit`, `/data/etc/httpd.conf` and `/data/migadmin.tar.gz` [11]. A cron entry in the logs runs a command tied to `/migadmin` [12]. Another entry shows an archive account named archive234 added from the CLI, with 79.141.169.187 as the remote server and /uploads as the remote directory [15]. That address is one of the two attacker IPs Fortinet published [23]. "This could indicate that the attacker configured the compromised FortiMail appliance to send archived data to a remote server," BleepingComputer wrote [16].
CISA's deadline falls three days after the listing [17]. When BleepingComputer asked for more detail on the exploitation, Fortinet referred customers to the advisory [21]. "Fortinet published an advisory to provide guidance regarding CVE-2026-104286 (FG-IR-26-175), including workarounds to help customers mitigate risk," Fortinet told BleepingComputer [20]. It said it is communicating with government organizations, including CISA [21].
Fortinet has not disclosed when exploitation began, how many systems were compromised, or who is behind the attacks [7]. The Hacker News reported the flaw in the same piece as in-the-wild exploitation of bugs in Check Point, Arista VeloCloud Orchestrator, F5 BIG-IP Access Policy Manager, Cisco Catalyst SD-WAN Manager and Citrix NetScaler ADC and Gateway [22]. With no actor named, the only links to those cases are timing and the type of product [7][22]. The only attacker infrastructure Fortinet has published for this campaign is two IP addresses [11].
What to watch
- Release of FortiMail 7.4.9, 7.6.7 or 8.0.2. Until one ships, moving a 7.2 appliance to 7.4 does not fix the flaw.
- A Fortinet or CISA attribution or exploitation start date. Either would show whether the FortiMail intrusions are part of the wider run of attacks on network appliances.
- New indicators beyond the two published IP addresses, such as other archive accounts or remote servers found in customer logs.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence78
- Adoption30
- Hype gap+8
- Incentives40
- Confidence76
Perspective Coverage
10 publishers- Builder
- Builder 10%
- Operator
- Operator 82%
- Investor
- Investor 8%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Fortinet published its advisory on October 1, 2026; CISA added CVE-2026-104286 to its Known Exploited Vulnerabilities catalog the same day and gave US federal civilian agencies until October 4, 2026, to address it.
- [2]
CVE-2026-104286, rated CVSS 9.8, allows unauthenticated attackers to write arbitrary files on the underlying FortiMail system; Fortinet acknowledged it has been exploited in the wild.
- [3]
Fortinet's advisory classifies the flaw as path traversal (CWE-22) and improper neutralization of NULL byte or NULL character (CWE-158), and says it "may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests".
- [4]
Fortinet will fix the flaw in FortiMail 8.0.2, 7.6.7 and 7.4.9, which have not been released, and advises 7.2 users to upgrade to the 7.4 branch or above.
- [5]
CISA requires federal agencies to perform forensic triage and mitigate the flaw.
- [6]
Affected versions: FortiMail 8.0.0 through 8.0.1 (upgrade to upcoming 8.0.2 or above), 7.6.0 through 7.6.6 (upcoming 7.6.7 or above), 7.4.0 through 7.4.8 (upcoming 7.4.9 or above), 7.2.0 through 7.2.9 (upgrade to branch 7.4 or above).
- [7]
Fortinet has not disclosed when the flaw was first exploited, how many systems were compromised, or who is behind the attacks.
- [8]
Until a patch is available, customers can disable IBE support with the CLI commands 'config system encryption ibe / set status disable / end', or alternatively block internet access to the management interface or restrict it to a trusted private network.
- [9]
IBE is FortiMail's identity-based encryption feature.
- [10]
BleepingComputer reports the flaw affects the FortiMail management interface and is being exploited in zero-day attacks to execute unauthorized code or commands on vulnerable devices.
- [11]
Fortinet's indicators of compromise: IP addresses 79.141.169.187 and 45.129.0.192; added files /data/lib/liblog.so, /data/bin/webconsole, /data/bin/mailservice, /data/etc/ld.so.preload; modified files /bin/smit, /data/etc/httpd.conf, /data/migadmin.tar.gz.
- [12]
Other log entries shared by Fortinet include a cron job executing a command related to /migadmin, an administrator logout event, an IBE decryption error due to invalid Base64 encoding, and failed login attempts.
- [13]
"FortiMail 7.2 users can patch the vulnerability by upgrading to the 7.4 branch or later."
- [14]
The vulnerability was discovered internally by Gwendal Guégniaud of Fortinet's Product Security team.
- [15]
A log entry in Fortinet's advisory shows an archive account named archive234 configured from the command line with 79.141.169.187 as the remote server and /uploads as the remote directory.
- [16]
"This could indicate that the attacker configured the compromised FortiMail appliance to send archived data to a remote server."
- [17]
CISA's federal deadline is three days after the KEV listing.
- [18]
No fixed FortiMail release exists on any affected branch as of the advisory: fixes for 7.4, 7.6 and 8.0 are unreleased, and the 7.2 upgrade route leads only to those branches.
- [19]
A 7.2 appliance upgraded to the 7.4 branch before 7.4.9 ships runs 7.4.8 or earlier, inside the affected 7.4.0 to 7.4.8 range.
- [20]
"Fortinet published an advisory to provide guidance regarding CVE-2026-104286 (FG-IR-26-175), including workarounds to help customers mitigate risk,"
- [21]
When BleepingComputer asked for more information about the exploitation activity, Fortinet referred customers to the advisory and said it is communicating with relevant government organizations, including CISA.
- [22]
The FortiMail disclosure comes as flaws in Check Point (CVE-2026-85102, CVE-2026-93616), Arista VeloCloud Orchestrator (CVE-2026-93952), F5 BIG-IP Access Policy Manager (CVE-2026-94127), Cisco Catalyst SD-WAN Manager (CVE-2026-76504) and Citrix NetScaler ADC and Gateway (CVE-2026-88771, CVE-2026-88772) have come under in-the-wild exploitation.
- [23]
The archive234 remote server, 79.141.169.187, is one of the two attacker IP addresses Fortinet published.
Sources
10 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comFortinet warns of critical FortiMail flaw exploited in zero-day attacks
2 articles · October 1, 2026
- Oct 2 Advisory: Fortinet FortiMail Path Traversal Vulnerability [CVE-2026-10426] - Censys
censys.com
1 article · October 2, 2026
- cisa.govCISA Adds One Known Exploited Vulnerability to Catalog
1 article · October 1, 2026
- helpnetsecurity.comCritical FortiMail zero-day exploited in the wild (CVE-2026-104286)
1 article · October 2, 2026
- Critical Path Traversal in Fortinet FortiMail Under Active Exploitation (CVE-2026-104286)
labs.beazley.security
1 article · October 1, 2026
- scworld.comFortinet FortiMail bug exploited in the wild, added to CISA KEV list
1 article · October 2, 2026
- securityaffairs.comU.S. CISA adds Fortinet FortiMail flaw to its Known Exploited Vulnerabilities catalog
1 article · October 1, 2026
- securityweek.comExploited Fortinet FortiMail Zero-Day Calls for Urgent Action
1 article · October 2, 2026
- thehackernews.comCritical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes
2 articles · October 2, 2026
- CVE-2026-104286: FortiMail Path Traversal Vulnerability Actively Exploited - Truesec
truesec.com
1 article · October 2, 2026
Topics and entities
Topics
- CISA Known Exploited Vulnerabilities
- Email Security Gateways
- Edge device vulnerabilities
- Zero-Day Exploitation