Critical FortiMail Zero – Day Exploited to Gain Unauthorized System Access
Fortinet has disclosed a critical zero-day vulnerability, tracked as CVE-2026-104286, affecting the FortiMail email security platform. The vulnerability carries a CVSS v3.1 score of 9.8 (Critical) and combines a path traversal weakness (CWE-22) with improper handling of NULL bytes (CWE-158). An unauthenticated remote attacker can exploit the flaw by sending specially crafted HTTP or HTTPS requests to an affected FortiMail system, allowing arbitrary files to be written to the underlying appliance. Fortinet confirms that the vulnerability has already been exploited in real-world zero-day attacks to execute unauthorized code or commands. Affected versions include FortiMail 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8, and 7.2.0–7.2.9.
The vulnerability affects functionality reachable through FortiMail's web interfaces and can be exploited without valid credentials or user interaction. By abusing the path traversal and NULL-byte handling flaws, an attacker can write malicious files into locations outside the intended directory structure, potentially enabling command execution, persistence, modification of system configuration, or additional malware deployment. Fortinet's investigation identified several maliciously added or modified files on compromised appliances, including /data/lib/liblog.so, /data/bin/webconsole, /data/bin/mailservice, and /data/etc/ld.so.preload. Fortinet also observed a suspicious archive account named archive234 configured to send archived data to an attacker-associated IP address, indicating that compromised FortiMail appliances may have been abused not only for persistence but potentially for collecting or transferring email-related data.
The vulnerability represents a significant risk because FortiMail commonly operates as a trusted email security gateway and may process sensitive inbound and outbound organizational communications. On October 1, 2026, CISA added CVE-2026-104286 to its Known Exploited Vulnerabilities (KEV) Catalog, requiring applicable U.S. federal agencies to perform forensic triage and mitigate the vulnerability by October 4, 2026. As of October 2, fixed builds for the affected 7.4, 7.6, and 8.0 branches were listed by Fortinet as upcoming, making immediate mitigation and compromise assessment particularly important. FortiMail 7.2 users are advised to upgrade to the 7.4 branch or later. Organizations operating affected FortiMail appliances should treat this as both an emergency remediation issue and a potential incident-response case because exploitation occurred before public disclosure.
Attack Surface
Email, Infrastructure
Tactics
Initial Access, Execution, Persistence, Collection, Privilege Escalation, Command and Control
Techniques
- T1190 – Exploit Public-Facing Application
- T1574.006 – Dynamic Linker Hijacking
- T1053.003 – Scheduled Task/Job: Cron
- T1105 – Ingress Tool Transfer
SuperPRO's Threat Countermeasures Procedures
- Immediately identify all FortiMail appliances running affected versions: FortiMail 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8, and 7.2.0–7.2.9. Prioritize systems whose management interface is reachable from the internet
- Apply the fixed FortiMail release as soon as it becomes available. Fortinet lists FortiMail 8.0.2, 7.6.7, and 7.4.9 as the fixed releases for the affected branches. FortiMail 7.2 deployments should upgrade to the 7.4 branch or later
- Disable Identity-Based Encryption (IBE) as an interim mitigation if patching cannot be performed immediately.
- Remove the FortiMail management interface from direct internet exposure or restrict access to trusted private networks, VPNs, jump hosts, or explicitly approved administrative IP addresses. Fortinet specifically recommends limiting management-interface exposure as an alternative workaround.
- Conduct forensic triage on vulnerable or previously exposed appliances, because CVE-2026-104286 was exploited as a zero-day before public disclosure. Review system logs, configuration changes, filesystem artifacts, scheduled tasks, and administrator activity rather than assuming that patching alone is sufficient.
- Search for Fortinet’s published IOCs, including the attacker-associated IP addresses 79.141.169.187 and 45.129.0.192, as well as the published hashes and suspicious files such as /data/lib/liblog.so, /data/bin/webconsole, /data/bin/mailservice, and /data/etc/ld.so.preload.
- Review FortiMail archive-account configuration for unauthorized changes, particularly an account named archive234, remote destination 79.141.169.187, or remote directory /uploads. Any matching configuration should be treated as a strong indication requiring incident-response investigation.
- Rotate credentials and secrets accessible to the appliance if compromise is suspected, including FortiMail administrator passwords, LDAP/Active Directory bind credentials, API keys, SMTP relay credentials, certificates, and other stored secrets.
