FortiMail CVE-2026-104286: Patch, Then Prove You Weren’t Compromised

This defender’s note covers affected versions, Fortinet’s workaround, and the indicators to check before you call the incident closed. It contains no exploit steps — only publicly published versions, fixes, and compromise indicators from Fortinet and CISA.

What the vulnerability is

Fortinet describes the issue as a path traversal (CWE-22) combined with improper handling of NULL bytes (CWE-158) in the FortiMail GUI. It can let an unauthenticated attacker write arbitrary files on the underlying system through crafted HTTP or HTTPS requests. Fortinet lists the impact as execution of unauthorized code or commands. The flaw sits in the Identity-Based Encryption (IBE) feature path, which is why Fortinet’s workaround focuses on IBE.

Fortinet has not said when exploitation began, how many devices were hit, or who is responsible. It found the bug internally and says it is coordinating with CISA.

Why it matters

Email gateways sit at the edge, see every message, and often hold credentials and archive settings. A device that lets an attacker write files without logging in is a direct path to persistence on one of the most trusted boxes in the network. Fortinet’s own indicators point to exactly that: added libraries, modified binaries, a preload hook, and a remote archive account configured to ship data to an outside server.

Affected versions and fixes

Per Fortinet advisory FG-IR-26-175 (updated October 5, 2026):

Fixed builds rolled out after the initial advisory, so confirm the release you need is actually available in your support portal before you plan around it.

Mitigate now if you can’t upgrade today

Fortinet’s interim options, in order of preference:

1. Turn off IBE support (Encryption, then IBE, then set IBE Service to off), or use the CLI command in Fortinet’s advisory.
2. Remove internet access to the FortiMail webmail interface, or limit it to trusted private networks.
3. If a web application firewall fronts FortiMail, apply the filtering rule Fortinet lists in the advisory.

A workaround reduces new risk. It does nothing about a device that was already compromised, which is why the next section matters more.

Check for compromise before you call it done

CISA’s forensic-triage requirement is the right instinct for everyone, not just federal agencies. Fortinet published these indicators:

Files added or modified (SHA-256):

Network indicators: 79[.]141.169.187 and 45[.]129.0.192.

Log patterns to look for:

• A cron event running a command that references /migadmin.
• An admin logout event from a null interface.
• A new archive account named archive234 added from the CLI with 79.141.169.187 as its remote destination.
• IBE decryption errors about invalid Base64 encoding, alongside failed logins for wildcard internal users.

Practical steps:

• Pull system event and encryption logs and search them for the patterns above, going back well before October 1.
• Review archive accounts and remote destinations, and remove anything you didn’t create.
• Check firewall and proxy logs for traffic to or from the two listed IPs.
• If anything matches, treat the device as compromised: isolate it, preserve logs and a configuration backup for investigation, engage Fortinet support, and rebuild from a known-good image rather than simply upgrading in place.
• Rotate credentials stored on or used by the appliance, including admin accounts, LDAP binds, and any archive or relay credentials.

The takeaway

This is the second edge-device emergency in as many weeks for many teams, after Citrix NetScaler (see our NetScaler defender checklist). The pattern is consistent: internet-facing management and service interfaces are the first thing attackers go after, and patching alone doesn’t tell you whether you were already hit. Keep management interfaces off the internet, know which optional features (like IBE) are actually in use, and build a habit of checking for indicators every time a KEV entry carries a forensic-triage flag.

If you want an outside check of what your mail gateways, VPNs and other edge services expose, our external infrastructure penetration testing covers internet-facing hosts, management interfaces and remote access; for teams in India see external infrastructure pentesting in India. Where a device may already have been compromised, an assumed-breach network and Active Directory test shows how far an attacker could move from it. Request a free scope review.

Sources

• Fortinet PSIRT advisory FG-IR-26-175
• BleepingComputer: Fortinet warns of critical FortiMail flaw exploited in zero-day attacks
• CISA Known Exploited Vulnerabilities Catalog
• Security.io: FortiMail zero-day reaches Monday as a compromise investigation