--- id: "CVE-2026-104286" kind: "vulnerability" aliases: ["CVE-2026-104286"] title: "fortinet fortimail: An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet\u2026" severity: "critical" cvss: 9.8 epss: null exploited: true status: "open" category: "vendor" products: [{"name": "Fortinet FortiMail", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Fortinet FortiMail", "fixed": ["7.4.9", "7.6.7", "8.0.2"], "affected": ">= 7.2.0, <= 7.2.9; >= 7.4.0, <= 7.4.8; >= 7.6.0, <= 7.6.6; >= 8.0.0, <= 8.0.1", "ecosystem": "vendor"}, {"name": "fortinet fortimail", "fixed": [], "affected": ">= 7.2.0, <= 7.4.8", "ecosystem": "vendor"}, {"name": "fortinet fortimail", "fixed": [], "affected": ">= 7.6.0, <= 7.6.6", "ecosystem": "vendor"}, {"name": "fortinet fortimail", "fixed": [], "affected": ">= 8.0.0, <= 8.0.1", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["email-gateway", "exploited", "fortimail", "fortinet", "ibe", "poc-public", "self-hosted", "vendor", "zero-day"] not_affected_if: ["fortimail-cloud", "ibe-disabled", "managed-hosting", "not-fortimail"] published_at: "2026-10-01T00:00:00+00:00" first_seen_at: "2026-10-23T19:11:50+00:00" updated_at: "2026-10-24T00:09:50+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-104286", "first_seen_at": "2026-10-23T19:11:50+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T20:14:47+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104286", "first_seen_at": "2026-10-23T23:44:52+00:00"}, {"source": "github-poc", "url": "https://github.com/CompleteTech-LLC/fortimail-cve-2026-104286-check", "first_seen_at": "2026-10-23T23:55:02+00:00"}] --- # fortinet fortimail: An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet… FortiMail path traversal plus NULL byte flaw (CWE-22/158) in the IBE web endpoint lets an unauthenticated attacker write arbitrary files over HTTP(S), which can lead to code execution. CVSS 9.8, exploited in the wild as a zero-day, and in CISA KEV since Oct 1, 2026. FortiMail Cloud was patched by Fortinet on Oct 5. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Fortinet FortiMail affected ? fixed ? - vendor:Fortinet FortiMail affected >= 7.2.0, <= 7.2.9; >= 7.4.0, <= 7.4.8; >= 7.6.0, <= 7.6.6; >= 8.0.0, <= 8.0.1 fixed 7.4.9, 7.6.7, 8.0.2 - vendor:fortinet fortimail affected >= 7.2.0, <= 7.4.8 fixed ? - vendor:fortinet fortimail affected >= 7.6.0, <= 7.6.6 fixed ? - vendor:fortinet fortimail affected >= 8.0.0, <= 8.0.1 fixed ? ## How to check Run 'show system encryption ibe' or look in the GUI under Encryption > IBE to see whether IBE Service is on (NCSC-NL says only IBE-enabled units are affected). Check the version with 'get system status': vulnerable is 7.2.0-7.2.9, 7.4.0-7.4.8, 7.6.0-7.6.6, 8.0.0-8.0.1. Hunt for Fortinet's IOCs: source IPs 79.141.169.187 and 45.129.0.192; a root cron event log entry running '/bin/sh -c O=/migadmin ...'; an unexpected archive account 'archive234' with remote-ip 79.141.169.187; IBE log lines 'Invalid Base64 Encoding at pos 0. Character=0x2a'. Also look for POST requests to /ibe containing '../' in web or WAF logs. ## Fix Upgrade to 7.4.9, 7.6.7 or 8.0.2 or later. FortiMail 7.2 has no fix in its own branch: move to 7.4 or later. Until patched, turn IBE off (GUI: Encryption > IBE > IBE Service off; CLI: config system encryption ibe / set status disable / end), or block internet access to the webmail interface, or have a WAF block POSTs to /ibe containing '../'. If IOCs match, treat the box as compromised and investigate (CISA asks for forensic triage). ## Timeline - 2026-10-23T19:11:50+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-104286 - 2026-10-23T20:14:47+00:00 analyst — Fortinet PSIRT FG-IR-26-175 (Oct 1, updated Oct 7): CVSS 9.8, exploited as zero-day, fixes 7.4.9/7.6.7/8.0.2; workaround is disabling IBE. No public PoC found. NCSC-NL says exposure requires IBE enabled; the PSIRT page does not state that condition. - 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-104286 - 2026-10-23T23:55:02+00:00 github-poc https://github.com/CompleteTech-LLC/fortimail-cve-2026-104286-check ## Documents - [advisory] Fortinet PSIRT FG-IR-26-175 FortiMail path traversal https://fortiguard.fortinet.com/psirt/FG-IR-26-175 - [discussion] BleepingComputer: FortiMail zero-day https://www.bleepingcomputer.com/news/security/fortinet-warns-of-critical-fortimail-flaw-exploited-in-zero-day-attacks/ - [discussion] NCSC-NL 2026-0398 https://advisories.ncsc.nl/2026/ncsc-2026-0398-0.pdf - [mitigation] Fortinet PSIRT FG-IR-26-175 FortiMail path traversal https://fortiguard.fortinet.com/psirt/FG-IR-26-175 - [poc] CompleteTech-LLC/fortimail-cve-2026-104286-check https://github.com/CompleteTech-LLC/fortimail-cve-2026-104286-check ## From the sources Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_