Fortinet FortiMail Zero-Day Under Attack: Your Questions Answered
Fortinet says a critical FortiMail flaw, CVE-2026-104286, is being used in zero-day attacks. Here is what owners need to know, in plain questions and answers.
Fortinet is warning customers that a critical flaw in its FortiMail email security appliances is already being used in real attacks. If your company routes mail through FortiMail, or a provider does so on your behalf, these are the questions worth answering today.
What is the flaw?
Tracked as CVE-2026-104286, the issue sits in the FortiMail management interface. Fortinet describes a combination of path traversal and improper handling of null characters that can let an unauthenticated attacker write arbitrary files on the underlying system through crafted HTTP or HTTPS requests. The company rates it critical, with a CVSS score of 9.8.
Which versions are affected?
According to Fortinet, the vulnerability affects FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9. It was discovered internally by Gwendal Guégniaud of Fortinet’s Product Security team.
Is it really being exploited?
Yes. Fortinet says the flaw is under active exploitation and published indicators of compromise, including files added or modified on compromised systems and two associated IP addresses. CISA has added CVE-2026-104286 to its Known Exploited Vulnerabilities catalog and set a federal mitigation deadline of October 4.
Is a patch available?
FortiMail 7.2 users can move to the 7.4 branch or later. For 7.4, 7.6, and 8.0, Fortinet lists upcoming fixed builds (7.4.9, 7.6.7, and 8.0.2) that are not yet available. Until then, the company urges workarounds.
What workarounds does Fortinet recommend?
One option is to disable IBE feature support with the published CLI commands. Another is to cut off internet access to the FortiMail management interface, or limit it to trusted private networks. Fortinet also shared log patterns that can help spot compromise, including an archive account pointed at a remote upload server.
What this means for your company
- Confirm whether you use FortiMail. Ask your IT provider or ISP if any mail gateway in your path is Fortinet FortiMail, including appliances you do not manage yourself.
- Apply workarounds now, then patch. Lock down management access and disable IBE if you can, then install the fixed builds as soon as they ship.
- Check for signs of compromise. Have someone review Fortinet’s IOC list and sample log events against your appliances before assuming you are clean.
Need help reviewing your email gateway and closing exposed management ports? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
These details are drawn from BleepingComputer’s report on Fortinet’s FortiMail zero-day advisory.
About The Author
