Follow Fortinet has disclosed a critical FortiMail zero-day vulnerability that attackers are already exploiting in the wild. Tracked as CVE-2026-104286 and rated 9.8 on the CVSS scale, the flaw enables an unauthenticated remote attacker to write arbitrary files to the underlying system by sending specially crafted HTTP or HTTPS requests.
The vulnerability poses a significant risk because FortiMail appliances are often positioned at the enterprise perimeter to protect email infrastructure against phishing, malware, spam, and business email compromise. A weakness that allows attackers to manipulate files on such an internet-facing security appliance can open the door to persistence, configuration tampering, malware deployment, and potentially broader compromise.
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on October 1, 2026, confirming that exploitation is not theoretical. Federal Civilian Executive Branch agencies were instructed to apply the vendor-recommended remediation or mitigations by October 4, highlighting the urgency of the issue.
Security teams looking for CVE-2026-104286 detection content can leverage SOC Prime’s AI-Native Detection Intelligence Platform to identify suspicious behavior associated with exploitation attempts and post-compromise activity. Click Explore Detections to access relevant detection rules and hunting queries mapped to MITRE ATT&CK® and compatible with multiple SIEM, EDR, and Data Lake technologies.
Security professionals can also use Uncoder AI to accelerate detection engineering by turning fresh threat intelligence and CVE-2026-104286 IOCs into custom hunting queries, generating detection logic, validating rules, visualizing attack flows, and translating detections across multiple security platforms.
CVE-2026-104286 analysis
The flaw is rooted in improper path restriction combined with inadequate handling of NULL-byte characters. Fortinet associates the weakness with path traversal (CWE-22) and improper neutralization of NULL bytes (CWE-158). By submitting crafted requests to a vulnerable FortiMail appliance, an unauthenticated attacker can manipulate file paths and write files outside their intended locations.
CVE-2026-104286 affects FortiMail 8.0.0 through 8.0.1, versions 7.6.0 through 7.6.6, versions 7.4.0 through 7.4.8, and versions 7.2.0 through 7.2.9, according to Fortinet’s advisory as cited by the two reports. Organizations operating any of these branches should consider exposed appliances at immediate risk, particularly when the management interface is reachable from the internet.
The absence of authentication is what makes the vulnerability especially dangerous. An attacker does not need valid FortiMail credentials or prior access to target the vulnerable component. Crafted HTTP or HTTPS requests alone can trigger arbitrary file-write behavior, significantly reducing the barrier to exploitation.
Arbitrary file write is also more consequential than simple file corruption. Depending on the location and contents of the files an attacker creates or modifies, the capability can be used to change configuration, introduce malicious libraries or executables, establish persistence, and potentially achieve unauthorized code or command execution. Several national cybersecurity authorities have consequently treated the flaw as presenting a remote code-execution risk, although Fortinet’s core vulnerability description specifically confirms arbitrary file writes.
Two IP addresses associated with the observed activity are 79.141.169[.]187 and 45.129.0[.]192.
Additional evidence reported from Fortinet’s indicators includes an archive account named archive234 configured to communicate with 79.141.169[.]187, root cron activity associated with /migadmin, unusual IBE decryption failures involving invalid Base64 data, and failed internal-user authentication attempts. These artifacts should be correlated with other host and network telemetry rather than treated individually as definitive proof of compromise.
A publicly indexed repository labeled as a CVE-2026-104286 PoC has also appeared. However, publicly available exploit repositories should be treated cautiously unless their behavior and technical accuracy have been independently validated. Active exploitation was already confirmed by Fortinet and CISA independently of any public proof-of-concept availability.
For defenders reviewing technical details for CVE-2026-104286, the combination of network accessibility, low attack complexity, no authentication requirement, and no required user interaction explains the critical 9.8 CVSS v3.1 rating. Organizations should Detect CVE-2026-104286 exploitation by looking beyond the initial malicious HTTP request. Monitoring should include unexpected files in FortiMail system directories, modifications to web-server configuration, suspicious preload-library changes, newly created accounts, abnormal cron activity, and outbound connections to unfamiliar infrastructure.
Because the flaw was exploited before public disclosure, simply applying a workaround does not establish that an appliance is clean. Any internet-exposed vulnerable FortiMail instance should be assessed for signs of prior compromise, with relevant logs and forensic artifacts preserved before disruptive remediation.
CVE-2026-104286 Mitigation
Fortinet recommends disabling Identity-Based Encryption (IBE) support as an immediate workaround where operationally feasible. Administrators can apply the following configuration:
config system encryption ibe
set status disable
end
Fortinet alternatively recommends removing the FortiMail management interface from direct internet exposure or restricting access exclusively to trusted private networks. There is no virtual patch listed in the current reporting.
For FortiMail 8.0, the vendor identifies version 8.0.2 or later as the corrected release path. FortiMail 7.6 customers should move to 7.6.7 or later, while FortiMail 7.4 installations should use 7.4.9 or later. For FortiMail 7.2, Fortinet advises upgrading to a newer branch. At the time of the latest reporting, the 8.0.2, 7.6.7, and 7.4.9 builds were still described as upcoming, so administrators should verify availability directly in Fortinet’s live advisory before scheduling an upgrade.
It is particularly important for organizations running the 7.2 branch not to interpret “upgrade to 7.4” as permission to move to any 7.4 release. Versions through 7.4.8 are themselves listed as vulnerable, so migration must ultimately land on a corrected release.
Alongside the primary CVE-2026-104286 mitigation, security teams should conduct compromise assessment on every vulnerable appliance that was publicly reachable. Review system and configuration changes, authentication events, cron jobs, newly introduced binaries or libraries, outbound connections, and administrator activity.
If any published indicators are identified, preserve logs and relevant files before remediation. Consider the appliance potentially compromised until investigation determines otherwise. Credentials and secrets accessible from the system should be rotated if compromise is confirmed or cannot be confidently excluded.
Organizations should also continuously monitor Fortinet’s advisory for updated fixed-build availability and additional indicators as the investigation evolves. SOC Prime’s AI-Native Detection Intelligence Platform can help defenders keep detection logic aligned with emerging exploitation patterns and post-exploitation behaviors.
Disclaimer: Detection content may not be available for every CVE. Check the SOC Prime Platform for current coverage. If relevant detections are not yet available, check again later as new detection content is continuously added.
FAQ
What is CVE-2026-104286 and how does it work?
CVE-2026-104286 is a critical Fortinet FortiMail vulnerability with a CVSS score of 9.8. It combines path traversal and improper NULL-byte handling, allowing an unauthenticated remote attacker to send crafted HTTP or HTTPS requests and write arbitrary files to the underlying appliance. That capability can enable configuration manipulation, persistence, malicious file placement, and follow-on compromise.
When was CVE-2026-104286 first discovered?
Fortinet publicly disclosed the vulnerability on October 1, 2026, in advisory FG-IR-26-175 and confirmed that exploitation had already occurred in the wild. Fortinet credited Gwendal Guégniaud of its Product Security team with discovering and reporting the issue internally, but the exact date of the original internal discovery has not been publicly specified.
What is the impact of CVE-2026-104286 on systems?
Successful exploitation allows an unauthenticated attacker to write arbitrary files on a vulnerable FortiMail appliance. In observed attacks, Fortinet identified new and modified system files, demonstrating that exploitation can materially alter appliance state. Arbitrary file-write capabilities may also facilitate persistence, configuration tampering, malicious code placement, and potentially unauthorized command execution.
Can CVE-2026-104286 still affect me in 2026?
Yes. Any affected FortiMail installation that has not been moved to a corrected release or protected with Fortinet’s recommended workaround remains at risk. The threat is immediate because exploitation has already been confirmed and the vulnerability is included in CISA’s KEV catalog. Internet-exposed management interfaces should receive the highest remediation priority.
How can I protect myself from CVE-2026-104286?
Disable FortiMail IBE functionality using Fortinet’s recommended CLI configuration or remove the management interface from internet exposure and restrict it to trusted networks. Monitor Fortinet’s advisory and upgrade to 8.0.2+, 7.6.7+, or 7.4.9+ once the appropriate corrected build is available. Organizations should also inspect vulnerable appliances for the published file, IP, account, cron, and log indicators because remediation alone cannot determine whether exploitation occurred before the workaround was applied.
