FortiMail Zero-Day CVE-2026-104286 Added to CISA KEV, Actively Exploited
FortiMail Zero-Day CVE-2026-104286 Added to CISA KEV, Actively Exploited
CISA added CVE-2026-104286, a CVSS 9.8 path-traversal flaw in Fortinet FortiMail, to its Known Exploited Vulnerabilities catalog on October 2, 2026. Unauthenticated attackers can write arbitrary files to the underlying system via crafted HTTP or HTTPS requests. Patches are not yet available for all affected versions; Fortinet has published workarounds.
CVE-2026-104286 is a path-traversal (CWE-22) and NULL byte/character neutralization (CWE-158) vulnerability in Fortinet FortiMail. It allows an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. CVSS score is 9.8. The vulnerability affects:
- FortiMail 8.0.0 through 8.0.1 (fix in upcoming 8.0.2 or above)
- FortiMail 7.6.0 through 7.6.6 (fix in upcoming 7.6.7 or above)
- FortiMail 7.4.0 through 7.4.8 (fix in upcoming 7.4.9 or above)
- FortiMail 7.2.0 through 7.2.9 (upgrade to branch 7.4 or above)
Fortinet confirmed active exploitation in the wild. CISA added the flaw to the KEV catalog following those reports.
Unauthenticated attackers can write arbitrary files to FortiMail systems running the affected versions. Fortinet has published indicators of compromise including two attacker IP addresses and seven file system paths (four added, three modified). The source does not specify the scope of organizations affected beyond FCEB agencies receiving an explicit remediation deadline.
CISA added CVE-2026-104286 to the KEV catalog on October 2, 2026. Federal Civilian Executive Branch agencies are directed to apply the patch or workarounds by October 4, 2026. Patch versions for most affected branches are described as "upcoming"; the source does not give a release date for those patches.
Affected platforms:
| FortiMail version | Status |
|---|---|
| 8.0.0 – 8.0.1 | Vulnerable; patch upcoming (8.0.2+) |
| 7.6.0 – 7.6.6 | Vulnerable; patch upcoming (7.6.7+) |
| 7.4.0 – 7.4.8 | Vulnerable; patch upcoming (7.4.9+) |
| 7.2.0 – 7.2.9 | Vulnerable; upgrade to 7.4 branch or above |
The source states no licensing requirements.
- Confirm whether your FortiMail deployment runs any affected version (8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8, 7.2.0–7.2.9).
- If patches are not yet available for your version, apply Fortinet's CLI workaround to disable IBE feature support:
`` config system encryption ibe set status disable end ``
- Restrict or remove internet access to the FortiMail management interface; limit access to trusted private networks only.
- Hunt for the published IOC IP addresses (79.141.169[.]187, 45.129.0[.]192) in network logs.
- Check file system integrity against the published IOC file paths:
- Added: /data/lib/liblog.so, /data/bin/webconsole, /data/bin/mailservice, /data/etc/ld.so.preload - Modified: /bin/smit, /data/etc/httpd.conf, /data/migadmin.tar.gz
- Apply the vendor patch immediately when your version's fix becomes available.
- FCEB agencies: the source gives an October 4, 2026 deadline for patch or workaround application.
My read is that the file paths listed in the IOCs suggest the attacker achieved persistent code execution. The addition of /data/etc/ld.so.preload is consistent with a technique used to force the OS dynamic linker to load attacker-controlled shared libraries before legitimate ones, which would survive a service restart. File integrity checks alone may not be sufficient if the system has already been compromised at the library-loading level. This is an architectural inference from the published IOC list; the source does not describe post-exploitation behavior explicitly.
My recommendation: treat internet-exposed FortiMail management interfaces as a priority regardless of patch availability. The workarounds Fortinet published address exposure surface, not the underlying flaw. I would apply both workarounds together rather than choosing one, and I would treat any FortiMail system that was internet-reachable before today as potentially compromised until a file integrity check against the published IOC paths comes back clean.
The source is a The Hacker News article dated October 2, 2026, covering the CISA KEV addition and Fortinet's advisory; it does not include the full Fortinet advisory text, patch release dates, or detail on post-exploitation behavior beyond the published IOCs.