Fortinet's FortiMail Zero-Day Lets Attackers Write Files Without Logging In

Fortinet disclosed a critical vulnerability in FortiMail, its email security gateway, on October 1, 2026, and said attackers were already using it. The flaw, tracked as CVE-2026-104286, carries a CVSS v3 score of 9.8 and lets an unauthenticated attacker write arbitrary files to the appliance through crafted HTTP or HTTPS requests. Fortinet's advisory credits Gwendal Guégniaud of the company's Product Security team with finding and reporting the issue internally, and it does not say when that happened.

Related reading: Cisco's SD-WAN Manager Zero-Day Lets Attackers In as Admin · Two Citrix NetScaler Zero-Days, Three Weeks Undetected, and Now Mass Exploitation.

FortiMail is not a consumer product. It is the email gateway an organization puts in front of its mail servers, and it reaches the public internet by design because mail does. A file-write bug on that box, reachable without a login, is the kind of flaw that turns a perimeter appliance into an attacker's foothold. CISA added the CVE to its Known Exploited Vulnerabilities catalog the same day it was disclosed and gave US federal civilian agencies until October 4 to carry out forensic triage and apply mitigations, according to The Hacker News.

The affected branches, per Fortinet's PSIRT advisory FG-IR-26-175, are FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9.

What the flaw actually does

The advisory files the bug under two weaknesses. The first is an improper limitation of a pathname to a restricted directory, CWE-22, the class usually called path traversal. The second is improper neutralization of a NULL byte or character, CWE-158. Put together, they let a request escape the location it is supposed to be confined to and write to a path the attacker chooses.

The distinguishing detail is where the write lands. Fortinet's table puts the component at the GUI, and its impact line reads "execute unauthorized code or commands." Arbitrary file write gives an attacker a footing. A file placed in the right directory can be loaded, executed, or used to alter the appliance's own configuration, which is why the workaround targets the request path itself.

The CVSS v3 score of 9.8 is not a judgment call. Fortinet's vector, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reads as network-reachable, low complexity, no privileges required, and no user interaction, with high impact on confidentiality, integrity and availability. An attacker who can reach the vulnerable interface needs no account and does not have to persuade an administrator to open anything. Writing files to the right location on an appliance is one step from running code on it.

“An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] and Improper Neutralization of NULL Byte or NULL Character [CWE-158] vulnerability may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.” — Fortinet PSIRT advisory FG-IR-26-175, October 1, 2026

Why an email gateway sits in the line of fire

An email security gateway is reachable from the internet because that is where email comes from. The same exposure that lets it filter inbound mail lets an attacker send requests at its management surface. FortiMail's own features widen that surface: the advisory's workaround disables IBE, the platform's identity-based encryption service, which places the reachable path inside functionality the product exists to offer.

Email is also a trust boundary. A gateway that inspects messages sees content many other systems do not, and it holds configuration and credentials for the mail flow it manages. An attacker who can write files to that system can change what it does with the mail in its care. Help Net Security noted the flaw was found internally and that Fortinet did not disclose when or where the attacks were spotted.

That combination is what makes this class of bug durable. Vendors cannot simply firewall the appliance off, because its job is to face outward. Operators can restrict the management interface to a trusted network, and Fortinet recommends exactly that, but the device still answers mail from anywhere.

The federal clock, and what it does not cover

CISA's KEV listing on October 1 set a deadline of October 4, 2026, for federal civilian agencies to run forensic triage and apply mitigations, The Register reported. Three calendar days, one of them a weekend. That clock binds federal agencies. It signals severity to everyone else, and it does not move private-sector appliances.

The window is short even by KEV standards, and it was set before Fortinet had finished shipping fixes for every branch. CISA's directive marks severity; it does not mean a patch was waiting. Agencies were told to triage first and mitigate with whatever was available, which in practice meant the workaround for anyone whose branch had no release yet. Private operators got no deadline at all, only a catalog entry.

The awkward part is what The Register documented: Fortinet listed fixes for several affected branches as "upcoming" when the alarm went out. An "upcoming" fix means an operator who follows the vendor's own guidance cannot patch yet and has to fall back on a workaround that changes product behavior. Help Net Security reported that the intended fixes were versions 8.0.2, 7.6.7 and 7.4.9, and that FortiMail 7.2 users should move to the 7.4 branch or above. The advisory's solution table names 8.0.2, 7.6.7 and 7.4.9 as the upgrade targets, with FortiMail 7.2 users directed to the 7.4 branch or above.

A 2026 run of exploited edge appliances

The FortiMail bug is not an isolated incident. The Hacker News lists it alongside a string of actively exploited edge and security appliances from 2026: Check Point (CVE-2026-85102 and CVE-2026-93616), Arista VeloCloud Orchestrator (CVE-2026-93952), F5 BIG-IP Access Policy Manager (CVE-2026-94127), Cisco Catalyst SD-WAN Manager (CVE-2026-76504), and Citrix NetScaler ADC and Gateway (CVE-2026-88771 and CVE-2026-88772).

TechPastWeek covered two of those episodes this month. The Cisco SD-WAN Manager zero-day was an authentication bypass that ended in an admin session; the Citrix NetScaler zero-days were mass-exploited over the same days. The pattern is consistent: internet-facing security and networking products, unauthenticated or pre-authentication bugs, and exploitation that begins before defenders have a patch in hand.

SecurityWeek framed the FortiMail disclosure as urgent action for exactly that reason. The appliances share a property that makes them attractive: they are trusted, they sit at the edge, and compromising one can reach everything behind it.

How to check a FortiMail for compromise

Fortinet published indicators of compromise, and the advisory is the place to start. It lists two attack IP addresses, 79.141.169[.]187 and 45.129.0[.]192, plus log patterns in the system event log and encryption log. The Hacker News reported additional file-level indicators: files added at /data/lib/liblog.so, /data/bin/webconsole, /data/bin/mailservice and /data/etc/ld.so.preload, along with modifications to /bin/smit, /data/etc/httpd.conf and /data/migadmin.tar.gz.

Two cautions belong with that list. Fortinet's event-log entries include ordinary-looking admin activity, so a single match needs context before it becomes a finding. And as The Register stressed, applying the workaround will not remove files or persistence mechanisms an attacker may already have placed. A host that matches an indicator needs a proper compromise investigation before it goes back into production.

The workaround, for however long it is needed

Where an upgrade is not yet possible, Fortinet's workaround does two things. It disables IBE support, either through the GUI under Encryption, then IBE, or with the CLI command config system encryption ibe followed by set status disable and end. And it tells administrators to block access to the FortiMail management interface from the internet or to restrict it to a trusted private network.

SOC Prime, reviewing the mitigation guidance on October 5, noted that no vendor-supplied virtual patch was listed, so the workaround is the option until a corrected build arrives.

Caveats

Fortinet has not said when the attacks began, who is behind them, or how many customers were compromised. The advisory acknowledges active exploitation and publishes indicators; it does not attribute the activity to a named group, and no credible attribution appears in the coverage reviewed here. Nothing in this story should be read as pointing at a particular actor.

The internal discovery date is also absent. The advisory credits Guégniaud and lists the disclosure on October 1, which is the public boundary of what is known. SOC Prime covered the same facts on October 5 without adding a timeline. Nor did Fortinet publish a fix for every branch at once, so the state of any single appliance depends on its version and on whether its operator moved.

One more thing the sources do not settle: how widely FortiMail is deployed against the internet. The population of exposed management interfaces is the number that would tell us how much risk remains, and nobody has published it.

What to watch

• Patch completion. Fortinet lists 8.0.2, 7.6.7 and 7.4.9 as the upgrade targets. Whether operators outside federal agencies have moved is the open question.
• Persistence checks. The workaround does not clean an already-compromised host. Indicators in the advisory's file and log lists are the starting point, not the end of an investigation.
• Updated indicators. Two IP addresses and a set of file paths describe what was seen, not everything an operator might face. New variants would widen the hunt.
• The next edge flaw. FortiMail joins a 2026 list that already includes Cisco, Citrix, Check Point, F5 and Arista. Treating any single patched appliance as the end of the problem misses the pattern.

Fortinet has patched the flaw. CISA's deadline for federal agencies passed on October 4, and no one has published how many of the other FortiMail appliances were updated first.

Cover image: "Fortinet FortiGate 6501F.png" by Premeditated via Wikimedia Commons, CC BY-SA 4.0. The photo shows a Fortinet appliance, not a FortiMail unit.