TL;DR: An unauthenticated attacker can write arbitrary files on FortiMail through crafted HTTP(S) requests. It's Critical, CVSS 9.8, and exploited in the wild. (Fortinet)
| Item | Detail | Source |
|---|---|---|
| CVE / severity | CVE-2026-104286, Critical, CVSSv3 9.8 (CWE-22, CWE-158) | Fortinet |
| Exploitation | "reported to be exploited in the wild"; Known Exploited: Yes | Fortinet |
| KEV | dateAdded 2026-10-01, dueDate 2026-10-04 | KEV |
| Affected → fixed | 8.0.0–8.0.1 → 8.0.2; 7.6.0–7.6.6 → 7.6.7; 7.4.0–7.4.8 → 7.4.9; 7.2.0–7.2.9 → move to 7.4+ | Fortinet |
| FortiMail Cloud | Remediated by Fortinet on Oct 5, 2026; no action needed | Fortinet |
| Workaround | Disable IBE (config system encryption ibe / set status disable), or restrict webmail access, or WAF-block POSTs to /ibe that contain '../' |
Fortinet |
Press: BleepingComputer covered the zero-day, IOCs and KEV addition. At publication (Oct 1), it noted fixed 7.4/7.6/8.0 builds were not yet available. Fortinet's advisory was updated with a solution on Oct 5. (BleepingComputer, Fortinet)
Post-install impact
No confirmed breakage found. The workaround disables IBE (Identity-Based Encryption), so encrypted-mail features stop working while it's in place. (Fortinet)
IOCs (IPs, log lines) are listed in the advisory. (Fortinet)
Last verified 2026-10-15Report an error: [email protected]