Fortinet warns of critical FortiMail flaw already exploited in the wild

Fortinet has warned customers about a critical vulnerability in its FortiMail product, tracked as CVE-2026-104286. According to the company, the flaw is already being actively exploited in zero-day attacks to execute unauthorized code or commands on vulnerable devices.

The vulnerability is rated critical — 9.8 on the CVSS scale — and affects the FortiMail management interface. Per the advisory, it combines a path traversal issue with improper handling of a NULL byte: an unauthenticated attacker can write arbitrary files to the underlying system via crafted HTTP or HTTPS requests. The flaw was found internally by Gwendal Guégniaud of Fortinet's Product Security team.

Affected versions

The problem affects FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9. Users on the 7.2 branch are advised to move to 7.4 or later. No fixes exist yet for the 7.4, 7.6, and 8.0 branches: Fortinet lists 7.4.9, 7.6.7, and 8.0.2 as upcoming releases that will carry the patch.

Temporary mitigations

Until updates ship, Fortinet recommends disabling IBE feature support with the relevant commands, or closing off the management interface from the internet and restricting it to trusted private networks.

Signs of compromise

Fortinet published indicators of compromise — several files added or modified on breached systems — along with two IP addresses tied to the attacks. The advisory also includes sample log entries. One shows an archive account configured with a remote server and a /uploads directory, which may indicate the attacker reconfigured the appliance to exfiltrate archived data. Other entries involve a cron job related to /migadmin, an administrator logout, an IBE decryption error, and failed login attempts.

Fortinet did not disclose when exploitation began, how many systems were compromised, or who is behind the attacks. Asked for more detail, the company pointed BleepingComputer to the advisory and said it is coordinating with government agencies, including CISA. The U.S. agency has already added CVE-2026-104286 to its Known Exploited Vulnerabilities catalog and ordered federal agencies to perform forensic triage and mitigate the flaw by October 4^th.

Source: Bleeping Computer