FortiMail Vulnerability CVE-2026-104286 Exploited as a Zero-Day

Summary

On 1 October 2026 Fortinet published advisory FG-IR-26-175 for FortiMail. FortiMail vulnerability CVE-2026-104286 is a path traversal flaw in the IBE (Identity Based Encryption) web feature. An unauthenticated attacker can use it to write arbitrary files to the device. The flaw was used in attacks before a fix existed (zero-day).

• CVSS v3: 9.8 (Critical)
• Affected versions: FortiMail 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8 and 7.2.0–7.2.9.
• Actively exploited: Yes.
• CISA KEV: Added to the catalog on 1 October 2026. The due date for US federal agencies was 4 October 2026.
• Remediation status: No fixed release yet. A temporary workaround exists.

Which versions are affected?

No fix is expected for the 7.2 branch. If you run 7.2, plan the move to 7.4 or a newer branch now.

What to do now

1. Take inventory: Check the version of each FortiMail device and whether the IBE feature is enabled.
2. Disable IBE: The first workaround is to turn IBE off. Run these commands in the CLI:

``` config system encryption ibe set status disable end ```

Disabling IBE also stops the encrypted email flow that depends on it. Tell your users in advance.

1. If you cannot disable IBE, restrict access: Restrict webmail access from the internet. Or, if a web application firewall (WAF) sits in front of the device, block POST requests to /ibe that contain ../.
2. Hunt for traces: Search your logs and configuration for the indicators of compromise (IoCs) below.
3. Update as soon as fixes ship: When 8.0.2, 7.6.7 or 7.4.9 is released, upgrade according to your branch. Back up the configuration first.
4. If you suspect compromise, run incident response: Isolate the device, preserve logs and configuration, and change the admin passwords and any other passwords stored on the device.
5. Check your data protection duties: If personal data such as email content was accessed, notification duties may apply. In Turkey, KVKK expects the Personal Data Protection Board to be notified within 72 hours of learning of the breach.

Workarounds do not replace the update. They only reduce the risk until a fixed release is available.

Indicators of compromise (IoCs)

• IP address: 79.141.169.187
• IP address: 45.129.0.192
• A remote "archive account" pointing at 79.141.169.187

Search your logs for connections from these IP addresses. If the archiving settings contain a remote archive account that you did not create, treat the device as compromised.

This advisory will be updated

We will update this advisory when Fortinet releases the fixed versions (8.0.2, 7.6.7 and 7.4.9).

How can Doğa Network help?

Our team can help you check FortiMail versions and configuration, restrict IBE and webmail access, investigate possible compromise, and plan the update once fixed versions are out. Call us on +90 850 888 3642 or email hi@doga.network.

Sources

• Fortinet PSIRT – FG-IR-26-175
• BleepingComputer – Fortinet warns of critical FortiMail flaw exploited in zero-day attacks
• Centre for Cybersecurity Belgium (CCB) – Warning: actively exploited FortiMail vulnerability
• CISA – CISA adds one known exploited vulnerability to catalog (1 October 2026)