Email Gateway Under Fire: Fortinet Discloses Critical FortiMail Path Traversal Zero-Day Under Active Attack (CVE-2026-104286)
Published on DigitalSpying.com | October 1, 2026
Author: DigitalSpying Threat Research Team
Threat Classification: Critical Zero-Day (CVSS v3.1: 9.8) | Active In-The-Wild Exploitation
Executive Summary
On October 1, 2026, Fortinet published an emergency security bulletin (FG-IR-26-175) warning organizations of a critical zero-day vulnerability in its FortiMail secure email gateway platforms. Tracked as CVE-2026-104286 and carrying a near-maximum CVSS severity score of 9.8, the flaw allows an unauthenticated, remote attacker to write arbitrary files to the underlying operating system by sending crafted HTTP or HTTPS requests to the appliance.
Confirming active in-the-wild exploitation, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) immediately added CVE-2026-104286 to its Known Exploited Vulnerabilities (KEV) catalog on the day of disclosure. CISA issued an urgent three-day remediation directive requiring federal civilian agencies to perform forensic triage and apply mitigations by October 4, 2026. Because Fortinet published the advisory before final firmware update builds were completed across all release branches, organizations must immediately apply temporary configuration workarounds and audit exposed gateways for signs of compromise.
Technical Deep-Dive: Deconstructing CVE-2026-104286
Vulnerability Mechanics & Root Cause
The vulnerability stems from a dangerous pairing of software weaknesses:
1. Path Traversal (CWE-22): The web server daemon handling external HTTP/HTTPS traffic fails to strictly restrict path parameters within incoming web requests to intended directories.
2. Improper Neutralization of Null Bytes (CWE-158): The parser mishandles null byte characters (%00 or 0x00), allowing attackers to terminate string checks prematurely, bypassing file extension filters and path validation routines.
The Attack Surface: Identity-Based Encryption (IBE) Portal
Detailed analyses from BleepingComputer and XHack indicate that the vulnerable code path runs through FortiMail’s Identity-Based Encryption (IBE) service:
* FortiMail’s IBE feature allows external, unauthenticated recipients to access encrypted emails via a web portal. Because external users inherently lack enterprise domain credentials, the IBE endpoint is intentionally exposed to the public internet.
* By sending crafted POST requests containing directory traversal sequences (../../) combined with null-byte sanitization bypasses, an attacker coerces the IBE processing daemon into saving uploaded payloads outside temporary staging folders and directly into web-accessible or executable system paths.
* Once an arbitrary file (such as a PHP script or executable binary) is written onto the underlying filesystem, the attacker executes it via a subsequent HTTP request, achieving full remote code execution in the context of the appliance's administrative service daemon.
[Unauthenticated Attacker]
│
│ 1. Dispatches crafted HTTP request to IBE endpoint
│ (Contains traversal sequences '../' & null bytes '0x00')
▼
[FortiMail Web Interface / IBE Portal]
│
│ 2. Fails path canonicalization & null-byte validation
▼
[Arbitrary File Write to Underlying Linux Filesystem]
│
│ 3. Attacker drops backdoor / web shell into web root
▼
[Remote Code Execution & Full Device Takeover]
│
│ 4. Direct access to stored mail, decrypted attachments, and LDAP secrets
▼
[Enterprise Network Compromise]
Affected Versions
The flaw impacts all major deployment branches of FortiMail:
* FortiMail 8.0: Versions 8.0.0 through 8.0.1
* FortiMail 7.6: Versions 7.6.0 through 7.6.6
* FortiMail 7.4: Versions 7.4.0 through 7.4.8
* FortiMail 7.2: Versions 7.2.0 through 7.2.9
Indicators of Compromise (IoCs) & Threat Hunting
Because threat actors actively targeted customer environments prior to public disclosure, security teams must treat every internet-facing FortiMail appliance as potentially exposed:
1. High-Fidelity Authentication Log Artifacts
Inspect FortiMail administrative access and event logs for failed login attempts containing anomalous character sequences:
* Log Pattern: Look for entries containing Character=0x2a' - Internal user *@domain.tld failed to log in.
* Significance: This pattern indicates an adversary attempting to fuzz authentication parameters and inject path-traversal sequences through the web login interface.
2. Filesystem Auditing
* Review file modification timestamps within /var/webui/, /opt/fortimail/, and /tmp/ for newly created .php, .sh, or ELF binary files.
* Inspect system crontab entries and administrative user databases for newly registered accounts.
3. Network Egress Telemetry
* Monitor outbound network traffic from FortiMail appliances for abnormal DNS tunneling, external SSH connections, or HTTPS connections to unrecognized foreign IP addresses.
Industry & Organizational Impact
Email gateways occupy a uniquely privileged position in enterprise network architectures:
* Complete Mail Espionage: FortiMail inspects, filters, and archives all inbound and outbound email traffic. Gaining root access allows adversaries to read unencrypted executive communications, intercept financial wire instructions, and steal intellectual property in real time.
* Trusted Phishing Launchpad: An attacker controlling the email gateway can inject spear-phishing messages directly into internal user inboxes, bypassing all downstream spam filters and domain reputation checks (SPF/DKIM/DMARC).
* Critical Infrastructure Risk: FortiMail is deployed heavily across defense contractors, healthcare networks, financial institutions, and government agencies. CISA’s inclusion of this bug under Binding Operational Directive (BOD) 26-04 highlights the acute threat to national security.
Urgent Mitigation & Remediation Roadmap
With vendor patch builds rolling out across branches, administrators must apply defensive workarounds immediately:
Step 1: Disable the Identity-Based Encryption (IBE) Feature
If your organization does not strictly require external web-based secure email retrieval, disable the IBE feature via the FortiMail CLI:config system global
set ibe-service disable
end
Step 2: Restrict Management Interface Access
* Ensure that the FortiMail web administration portal is strictly bound to internal management VLANs.
* Block public internet access to administrative web ports (HTTP/HTTPS) using upstream perimeter firewalls or access control lists (ACLs).
Step 3: Forensic Triage Before Upgrading
* In accordance with CISA's forensic triage requirements, preserve memory snapshots, configuration backups, and full system logs prior to rebooting or applying patches.
* If signs of unauthorized file creation or active compromise are confirmed, isolate the appliance immediately, revoke all hosted SSL/TLS certificates and administrative credentials, and engage incident response specialists.
Step 4: Apply Official Vendor Builds
* Monitor the Fortinet PSIRT portal for release announcements and upgrade to the patched firmware build for your branch as soon as it becomes available.
References & Official Sources
* Fortinet PSIRT Advisory: FG-IR-26-175 (CVE-2026-104286)
* CISA Alert: CISA Adds One Known Exploited Vulnerability to Catalog (CVE-2026-104286)
* BleepingComputer: Fortinet Warns of Critical FortiMail Flaw Exploited in Zero-Day Attacks
* watchTowr Vulnerability Intelligence: Fortinet FortiMail CVE-2026-104286 FAQ
* XHack Security: The Critical FortiMail Bug That Writes Files