DIQQAT! FortiMail is being exploited in 0-day vulnerabilities during attacks!

ALERT! Exploitation is actively taking place in attacks on FortiMail devices due to a 0-day vulnerability! It has been determined that the digital critical vulnerability CVE-2026-104286 in Fortinet FortiMail email security devices is actively being exploited by attackers in real attacks. The vulnerability has been assigned a score of 9.8 according to CVSS 3.1, allowing unauthenticated, i.e., those without account credentials on the system, remote attackers to write arbitrary files on the device's main system via specially crafted HTTP or HTTPS requests. Fortinet announced the security bulletin FG-IR-26-175 regarding this issue on October 1, 2026. The most important point is that the vendor has confirmed that the vulnerability is being exploited. Patches are being released for some FortiMail versions but are not yet available, so Fortinet recommends applying temporary protection measures immediately. What is the vulnerability dangerous? CVE-2026-104286 consists of a combination of two issues: - CWE-22 — Path Traversal, which allows access to file paths outside of the specified directory limits; - CWE-158 — Improper handling of NULL bytes, which is related to the application not securely processing data using NULL characters. By exploiting these vulnerabilities together, an unauthenticated attacker can write unauthorized files to the FortiMail device's main file system by sending specially crafted HTTP or HTTPS requests. Simply put, the attacker does not need to have a user account on FortiMail or log in with a password. The vulnerable service itself over the internet can be sufficient for the attack. This is especially dangerous because FortiMail is not just a regular user computer. It is considered a security device located at the edge of an organization's email infrastructure and network. Loss of control over such a device can pose a risk to email flows, authentication information, and internal network resources. The most dangerous aspect of the 0-day vulnerability is that attacks are already underway. This vulnerability should not be assessed as a simple newly discovered bug. Fortinet has confirmed that it is being exploited in real attacks. Therefore, CVE-2026-104286 falls into the "0-day" category—meaning the existence and need for protection of the vulnerability are known to the public at the time attackers are exploiting it. Furthermore, the vulnerability was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on October 1, 2026. This catalog is used to track vulnerabilities that are being used in real attacks for separate monitoring. Fortinet has not yet provided detailed information on who the attackers are, when the exploitation started, or how many organizations' devices have been compromised. Therefore, it is important to investigate the known exploitation status based on available indicators. Which FortiMail versions are at risk? According to Fortinet data, the following versions are vulnerable: | FortiMail Network | Vulnerable Versions | Patch Version | |---|---|---| | 8.0 | 8.0.0 – 8.0.1 | 8.0.2 or later | | 7.6 | 7.6.0 – 7.6.6 | 7.6.7 or later | | 7.4 | 7.4.0 – 7.4.8 | 7.4.9 or later | | 7.2 | 7.2.0 – 7.2.9 | Transition to network 7.4 or later is recommended | This version range is indicated by Fortinet warnings and independent security sources. Therefore, administrators should not consider the device safe based solely on whether they are using "7.x" or "8.x" versions. For example, the initial versions of the 7.4 network may also be vulnerable. What to do if no patch is available? Fortinet has recommended temporary measures to protect vulnerable devices. One of them is temporarily disabling the IBE (Identity-Based Encryption) function. According to Fortinet's instructions, the following setting can be used via the CLI: config system encryption ibe set status disable end However, because such changes can affect the organization's email infrastructure, they must be evaluated by relevant technical and security personnel before use in a production environment. The second important measure is to block direct access to the FortiMail management interface from the internet. Access to the management interface should be restricted to: - only trusted internal networks; - via VPN; - a limited list of administrative IP addresses, as appropriate. Fortinet also recommends restricting access to the management interface from the internet or limiting it to trusted private networks. Important: Closing the management interface does not imply that the device is not compromised. If FortiMail is running on an internet-exposed and vulnerable version, simply closing the management interface does not mean that previous attacks have not occurred. Therefore, the device must be checked after applying temporary protection measures. Particular attention should be paid to the following situations: - Appearance of unexpected or unknown files; - Modification of system files; - Unknown cron jobs; - New or modified administrator accounts; - Unusual external network connections; - Access attempts to unknown remote servers; - Unintelligible changes in the configuration; - Unexpected authentication events; - Abnormal activities by administrators. How has Fortinet indicated compromise signs? In its recommendations, Fortinet listed several file and system changes that may be observed during attacks. These include the following paths: /data/lib/liblog.so /data/bin/webconsole /data/bin/mailservice /data/etc/ld.so.preload /bin/smit /data/etc/httpd.conf /data/migadmin.tar.gz The mere existence of these files does not prove that the device is compromised, but if they are found in conjunction with Fortinet's IoCs, further investigation is necessary. Fortinet also provided MD5 and SHA-256 hash values for these files. Suspicious Network Addresses and Configuration Changes Fortinet also indicated two IP addresses in its indicators: 79[.]141.169.187 45[.]129.0.192 The first address is associated with a suspicious configuration write indicating that an archive account named archive234 was created and settings to send archive data to a remote server were configured. It indicates that the address 79.141.169.187 and the /uploads catalog were recorded. This configuration may have been created by the organization, so it should not be automatically assessed as evidence of an attack. However, if it is found along with other indicators provided by Fortinet, further investigation is required. What to look for in the Logs? Fortinet also listed several log events that may be related to the attack. Including: /migadmin related root cron command; - logout event recorded with administrator's (null) interface value; - errors related to incorrect Base64 data in the IBE module; - failed login attempts by internal users; - unexpected archive accounts or remote archive addresses. It is not sufficient to examine these events individually. They need to be correlated over time, and linked with device configurations and file system changes. For example, if an unknown cron job, subsequent file changes, and connections to an unknown external IP address are observed within the same time frame, these events may be interrelated. How can the Attacker use the File Writing Capability? Fortinet has not fully disclosed all stages of exploitation of the vulnerability to the public. Therefore, it is not accurate to draw a definitive conclusion about exactly which final attack chain attackers are using. However, the ability to write unauthorized files poses a serious risk to the security device. This capability can lead to consequences such as: - Modifying important files on the system; - Placing malicious code or other components; - Affecting the operation of services; - Creating a persistent access mechanism for future attacks; - Modifying data on the device; - Using the device for subsequent attacks against the email infrastructure. Therefore, the ability to write unauthorized files on a security device located at the network edge, like FortiMail, poses a broader risk than a simple web application error. What should Organizations do now? For organizations using FortiMail, the following practical steps are important to take: 1. Inventory all FortiMail devices Gather information on all FortiMail devices in the organization, including their: - model; - FortiMail version; - internet exposure; - management interface; - administrator accounts. Specifically, FortiMail systems in branch offices, backup devices, and separate networks should also be checked. 2. Check the version and upgrade to the patched version If a device is on a vulnerable version, it should be updated to the corresponding patched version as quickly as possible. According to Fortinet data, relevant fixes are shown in versions 7.4.9, 7.6.7, and 8.0.2. For users on the 7.2 network, transitioning to network 7.4 or later is recommended. 3. Enable temporary protection if no upgrade is possible Disabling the IBE function and restricting the management interface to trusted networks are part of the temporary measures recommended by Fortinet. 4. Check internet-exposed management interfaces If the FortiMail management panel is directly exposed to the internet, it should be used only via a VPN or another trusted protected channel. 5. Perform IoC checks The device should be checked based on the following information provided by Fortinet: - file paths; - file hashes; - IP addresses; - cron entries; - configuration changes; - log events. 6. Retain Logs If suspicious activity is detected on the device, logs should not be deleted or overwritten. They can be important evidence for subsequent digital forensics and incident investigation. 7. Check Administrator Accounts Check for unknown administrators, newly created accounts, changed passwords, and unexpected authentication events. 8. Do Not Rely Only on Updates if Compromise is Detected If signs of device compromise are detected, simply updating may not be enough. It is necessary to determine when the incident started, what changes were made, and whether other systems were affected. In necessary cases, it is required to restore the device according to Fortinet's instructions, replace administrator and other relevant authentication information, and check additional systems on the network. Important Note CVE-2026-104286 should not be confused with vulnerabilities in previous Fortinet products. For example, other vulnerabilities affecting FortiMail and other Fortinet products were also discovered in 2025. CVE-2026-104286 is a separate vulnerability and is related to the versions of FortiMail mentioned above. Furthermore, Fortinet has not disclosed the identity of the attackers, the start time of the attacks, or the number of affected organizations. Therefore, it is important to conduct investigations based on the available IoCs and monitor the vendor's new recommendations. CVE-2026-104286 is a critical vulnerability that requires immediate action for FortiMail users. The risk is further increased by its CVSS 9.8 rating, its unauthenticated usability, and most importantly, its active exploitation in real attacks. Organizations must check the version of their FortiMail devices, upgrade to the corresponding patched version, apply the temporary protection measures recommended by Fortinet, and strictly restrict external access to the management interface. If the FortiMail device is running on a vulnerable version exposed to the internet, it should not be limited to just updating, but also check the probability of previous attacks. Complex analysis of files, configuration, cron jobs, administrator accounts, logs, and external network connections is important to determine whether the device is actually compromised or not.