Fortinet warns of critical FortiMail vulnerability exploited in zero-day attacks

Fortinet is warning customers about a critical FortiMail vulnerability, CVE-2026-104286, which is being actively exploited in zero-day attacks to execute unauthorized code or commands on vulnerable devices.

The vulnerability is classified as critical with a CVSS score of 9.8 and affects the FortiMail administration interface.

“A vulnerability related to improper restriction of a pathname to a restricted directory (“path traversal”) (CWE-22) and improper neutralization of NULL bytes or NULL characters (CWE-158) could allow an unauthenticated attacker to write arbitrary files to the underlying system via crafted HTTP or HTTPS requests,” Fortinet said in a consultation Published Thursday.

Gwendal Guégniaud from Fortinet’s product security team discovered the vulnerability internally and affects FortiMail 8.0.0 to 8.0.1, FortiMail 7.6.0 to 7.6.6, FortiMail 7.4.0 to 7.4.8 and FortiMail 7.2.0 to 7.2.9.

Fortinet says the vulnerability is being actively exploited and urges customers to apply the common workarounds until a security update can be installed.

FortiMail 7.2 users can fix the vulnerability by updating to the 7.4 branch or later. No security updates are yet available for affected installations of FortiMail 7.4, 7.6 and 8.0. Fortinet lists FortiMail 7.4.9, 7.6.7 and 8.0.2 as upcoming versions that contain the fix.

Until patched versions are available, Fortinet says administrators can resolve the bug by disabling IBE feature support using the following commands:

config system encryption ibe
set status disable
end

As an alternative workaround, administrators can disable access to the FortiMail management interface over the Internet or restrict access to trusted private networks.

Fortinet also released Indicators of Compromise (IOCs) related to the attacks, including several files that were added or modified on compromised systems.

Fortinet is also listed 79(.)141.169.187 And 45(.)129.0.192 B. IP addresses associated with the attacks.

The advisory also contains log entries that administrators can use to identify potentially vulnerable appliances.

One of these entries shows an archive account with the name archive234 is configured via the command line 79.141.169.187 as a remote server and /uploads as a remote directory. This could indicate that the attacker configured the compromised FortiMail appliance to send archived data to a remote server.

Other log entries include a cron job that executes a corresponding command /migadminan administrator logout event, an IBE decryption failure due to invalid base64 encoding, and failed login attempts.

Example log events shared by Fortinet are listed below:

type=event subtype=system pri=debug user=system ui=cron msg="(root) CMD (/bin/sh -c 'O=/migadmin ...
- type=kevent subtype=admin pri=information user=admin ui=(null) action=logout status=success reason=unknown msg="User admin logged out from (null)."
- type=kevent subtype=config pri=information user=admin ui=cli module=unknown submodule=unknown msg="Added 'archive234' to 'archive account' : rotation-size(50)rotation-time(1) rotation-hour(14)destination(remote)remote-ip(79.141.169.187)remote-username(archive234)remote-password(***)remote-directory(/uploads) (user: admin, from: cli)"
- FortiMail::IBE::DecrypterMediaIn::DecrypterMediaIn(FortiMail::MediaIn&, const FortiMail::IBE::KeyFinder&, const FortiMail::EmailAddress&, const FortiMail::Buffer&, FortiMail::IBE::DecrypterMediaIn::Version): Caught BufferException(2), BufferImpl.cpp:973, 'Invalid Base64 Encoding at pos 0. Character=0x2a'
- Internal user *@domain.tld failed to log in.

Fortinet has not disclosed when the vulnerability was first exploited, how many systems were compromised, or who was behind the attacks.

When BleepingComputer asked for more information about the exploitation activity, Fortinet referred customers to the advisory and said it was coordinating with government agencies, including CISA.

“Fortinet has published an advisory to provide guidance regarding CVE-2026-104286 (FG-IR-26-175), including workarounds to help customers mitigate risk,” Fortinet told BleepingComputer.

“Consistent with Fortinet’s commitment to responsible PSIRT disclosure and public-private partnerships, we are communicating with relevant government organizations, including CISA, about the content of this advisory.”

CISA has now added vulnerability CVE-2026-104286 to its catalog of known exploited vulnerabilities and requires federal agencies to conduct forensic triage and remediate the vulnerability by October 4th.