A FortiMail zero-day tracked as CVE-2026-104286 is being actively exploited against vulnerable Fortinet FortiMail systems, with the flaw allowing unauthenticated attackers to write arbitrary files to the underlying appliance through crafted HTTP or HTTPS requests.
Fortinet’s PSIRT advisory FG-IR-26-175 rates the vulnerability Critical with a CVSS score of 9.8. The company says exploitation has been observed in the wild, making immediate exposure reduction and remediation a priority for organizations running affected FortiMail versions.
The U.S. Cybersecurity and Infrastructure Security Agency has also added CVE-2026-104286 to its Known Exploited Vulnerabilities catalog, confirming that the vulnerability is being used in real-world attacks.
FortiMail Zero-Day Affects Multiple Supported Branches
The vulnerability affects several current FortiMail release branches, including 8.0, 7.6, 7.4 and 7.2.
| FortiMail branch | Affected versions | Remediation status |
|---|---|---|
| 8.0 | 8.0.0 through 8.0.1 | Upgrade to 8.0.2 or later when available |
| 7.6 | 7.6.0 through 7.6.6 | Upgrade to 7.6.7 or later when available |
| 7.4 | 7.4.0 through 7.4.8 | Upgrade to 7.4.9 or later when available |
| 7.2 | 7.2.0 through 7.2.9 | Move to a supported later branch per Fortinet guidance |
At the time of writing, Fortinet’s advisory lists the fixed builds for the 8.0, 7.6 and 7.4 branches as upcoming. That means organizations should not wait for patch availability before reducing exposure.
How CVE-2026-104286 Works
CVE-2026-104286 combines improper pathname restriction with improper handling of NULL-byte characters in the FortiMail management interface.
In practical terms, the issue can allow a remote unauthenticated attacker to send specially crafted HTTP or HTTPS requests that cause FortiMail to write files outside the directory where the application expects them to be stored.
Arbitrary file-write vulnerabilities are particularly dangerous on security appliances because an attacker may be able to place files in locations that affect service behavior, persistence or code execution.
Fortinet’s published CVSS vector reflects a network-accessible vulnerability requiring no privileges and no user interaction. That combination helps explain the 9.8 Critical severity rating.
Active Exploitation Makes This an Emergency Remediation Issue
This is not a theoretical vulnerability or a proof-of-concept-only disclosure. Fortinet says the flaw has been exploited in the wild, and CISA has independently placed it in the KEV catalog.
That distinction matters for defenders. Once exploitation is confirmed, organizations need to consider not only whether the system can be patched, but also whether it may already have been compromised.
FortiMail systems are often deployed close to an organization’s email perimeter, which can make management-interface exposure especially important to review. Administrators should determine whether affected management interfaces are reachable from the public internet and whether Identity-Based Encryption functionality is enabled.
Organizations tracking actively exploited enterprise vulnerabilities can also use CyberUpdates365’s 2026 CVE and enterprise security hub for related remediation guidance and current exploit activity.
Fortinet Recommends Disabling IBE or Restricting Management Access
Until the appropriate fixed release is available and installed, Fortinet recommends disabling Identity-Based Encryption support or removing the FortiMail management interface from public internet access.
Fortinet’s documented CLI workaround for disabling IBE is:
- Run:
config system encryption ibe - Then:
set status disable - Finish with:
end
The alternative is to restrict the FortiMail management interface so that it is reachable only from a trusted private network.
For internet-facing FortiMail deployments, reducing management-plane exposure should be treated as an immediate control rather than waiting for the next maintenance window.
What FortiMail Administrators Should Do Now
Security teams should first identify every FortiMail appliance and verify its exact software version. Systems running the affected versions should then be checked for public management-interface exposure and placed behind trusted-network access controls where possible.
Administrators should also determine whether IBE is enabled and apply Fortinet’s workaround if business requirements allow it.
Because exploitation has already been confirmed, remediation should include incident-response considerations as well as configuration changes. Preserve relevant logs and appliance evidence before making destructive changes, particularly if unusual files, management activity or outbound connections are discovered.
Once Fortinet publishes the fixed build for the relevant branch, organizations should install it promptly and verify the running version after the maintenance window.
Why FortiMail Exposure Matters
Security appliances deserve a different level of urgency from ordinary endpoint applications because they often sit at high-trust boundaries and process sensitive traffic.
A vulnerable mail-security gateway may handle inbound and outbound email, anti-malware inspection, filtering and encryption workflows. Compromise of that infrastructure can therefore create broader operational and security risk than a vulnerability confined to a low-privilege desktop application.
The active exploitation of CVE-2026-104286 is another reminder that edge-facing security products should have management interfaces isolated from the public internet wherever possible, even when authentication is normally required.
Organizations using Fortinet products should verify the current Fortinet advisory before applying changes, as fixed-version availability and incident-response guidance may change as Fortinet updates the advisory.
