{"id":"fortimail-ibe-path-traversal-oct-2026","category":"patch","status":"live","title":"Fortinet FortiMail unauthenticated file-write flaw CVE-2026-104286 exploited; fixes for 7.4, 7.6, 8.0","tldr":"Fortinet FortiMail email gateways have a critical flaw (CVE-2026-104286) that lets anyone on the internet write files without logging in. It is being exploited. Update to 8.0.2, 7.6.7 or 7.4.9; 7.2 awaits 7.2.10 and 7.0 has no fix. Cloud is already fixed.","summary":"Fortinet disclosed on 1 October 2026 that its FortiMail email security gateway has a critical path traversal flaw, CVE-2026-104286 (CVSS 9.8), in the web interface's identity-based encryption (IBE) feature. An attacker with no login can send crafted web requests and write files on the appliance. Fortinet says it is being exploited, and CISA listed it as exploited the same day. Fortinet has not said who is behind the attacks or how many systems were hit, though it shared indicators so administrators can check. The flaw affects FortiMail 8.0.0 to 8.0.1, 7.6.0 to 7.6.6, 7.4.0 to 7.4.8 and 7.2.0 to 7.2.9, plus all of 7.0. Fixed releases are 8.0.2, 7.6.7 and 7.4.9. Version 7.2.10 is still described as upcoming, and 7.0 users must migrate. Fortinet fixed FortiMail Cloud on 5 October. Workarounds are to switch off the IBE service, keep the webmail interface off the internet, or block POST requests to /ibe containing ../ at a web firewall.","action":"If you or your business run FortiMail, upgrade to 8.0.2, 7.6.7 or 7.4.9, and check the advisory for compromise indicators. Until then, turn off the IBE service and keep the webmail interface off the internet; ask your IT provider if unsure. Home users have nothing to do.","product":"Fortinet FortiMail email security gateway (8.0, 7.6, 7.4, 7.2, 7.0)","audience":"work","severity":"critical","patch":"partial","exploited":true,"cves":["CVE-2026-104286"],"tags":["fortinet","fortimail","path-traversal","zero-day","email-gateway","cisa-kev","exploited"],"affected":["FortiMail 8.0.0 through 8.0.1","FortiMail 7.6.0 through 7.6.6","FortiMail 7.4.0 through 7.4.8","FortiMail 7.2.0 through 7.2.9","FortiMail 7.0 all versions"],"fixed":["FortiMail 8.0.2","FortiMail 7.6.7","FortiMail 7.4.9","FortiMail 7.2.10 (upcoming)","FortiMail Cloud (remediated by Fortinet 2026-10-05)"],"matches":[],"sources":[{"kind":"advisory","title":"FG-IR-26-175: FortiMail path traversal and NULL byte vulnerability","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-175","by":"Fortinet PSIRT","date":"2026-10-07"},{"kind":"news","title":"Critical FortiMail zero-day exploited in the wild (CVE-2026-104286)","url":"https://www.helpnetsecurity.com/2026/10/02/fortinet-fortimail-vulnerability-cve-2026-104286/","by":"Help Net Security","date":"2026-10-02"}],"started":"2026-10-01","closed":null,"created":"2026-11-03T21:59:14.844Z","updated":"2026-11-03T21:59:14.844Z","cve_notes":[{"cve":"CVE-2026-104286","name":"Path traversal in FortiMail's IBE web interface","what":"A path traversal combined with NULL byte mishandling in FortiMail's web interface that lets an unauthenticated attacker write arbitrary files on the appliance through crafted HTTP or HTTPS requests.","severity":"critical","cvss":9.8}],"timeline":[{"at":"2026-10-07","added":"2026-11-03T21:58:27.032Z","kind":"vendor-revised","text":"Fortinet clarified the FortiMail Cloud fix in the advisory, the last revision listed. Customers of the cloud service need take no action.","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-175","by":"Fortinet","patch":"partial"},{"at":"2026-10-05","added":"2026-11-03T21:58:27.032Z","kind":"new-fix","text":"Fortinet updated the advisory with fixed releases: 8.0.2, 7.6.7 and 7.4.9. FortiMail Cloud was remediated by Fortinet on 5 October. A 7.2.10 release was still described as upcoming, and 7.0 has no fix.","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-175","by":"Fortinet","patch":"partial"},{"at":"2026-10-01","added":"2026-11-03T21:58:27.032Z","kind":"cisa-added","text":"CISA added CVE-2026-104286 to its Known Exploited Vulnerabilities list, with a 4 October deadline for US federal civilian agencies.","url":"https://www.helpnetsecurity.com/2026/10/02/fortinet-fortimail-vulnerability-cve-2026-104286/","by":"Help Net Security","patch":null},{"at":"2026-10-01","added":"2026-11-03T21:58:27.032Z","kind":"disclosed","text":"Fortinet published advisory FG-IR-26-175 for CVE-2026-104286, a critical (CVSS 9.8) flaw in FortiMail that lets an unauthenticated attacker write files via crafted web requests, and said it was being exploited. At publication no fixed release was out; fixes were planned for 8.0.2, 7.6.7 and 7.4.9.","url":"https://www.helpnetsecurity.com/2026/10/02/fortinet-fortimail-vulnerability-cve-2026-104286/","by":"Help Net Security","patch":"none"}],"url":"https://hard.fyi/live/fortimail-ibe-path-traversal-oct-2026/","json":"https://hard.fyi/api/live?id=fortimail-ibe-path-traversal-oct-2026"}