Summary

Fortinet FortiMail is affected by CVE-2026-104286, a critical path traversal flaw (CVSS 9.8) in its web interface. It lets unauthenticated attackers write arbitrary files on the underlying system through crafted HTTP or HTTPS requests. The flaw was exploited in the wild as a zero-day and enables root-level command execution and mail theft through rogue archive accounts. The flaw is now patched, and organizations should upgrade immediately or disable the IBE service until they can.

Vulnerability Details

Affected products and CVEs

Recommendations

1. 01
   Upgrade FortiMail Without Delay

   Upgrade FortiMail 8.0 to 8.0.2 or above, 7.6 to 7.6.7 or above, and 7.4 to 7.4.9 or above. Appliances on the 7.2 branch have no fix within that branch and must be migrated to 7.4 or above. Confirm the running build on every appliance after the upgrade, including HA peers and virtual instances.
2. 02
   Disable the IBE Service Until Patched

   Where an upgrade cannot be applied immediately, turn off Identity-Based Encryption in the GUI under Encryption, IBE, by setting IBE Service to off, or from the CLI by running config system encryption ibe, set status disable, and end. This closes the code path the vendor identifies as exploitable, so coordinate the change with mail operations because it may affect users who rely on IBE-encrypted mail.
3. 03
   Remove Internet Exposure of the Webmail Interface

   Disable access to the FortiMail webmail interface from the internet or limit it to trusted private networks only. Appliances whose web interfaces are reachable from the internet, particularly those with IBE enabled, should be remediated first.
4. 04
   Block Traversal Attempts at the WAF

   If a web application firewall sits in front of FortiMail, block POST requests to /ibe that contain the ../ sequence and log every match as a potential exploitation attempt for follow-up investigation.
5. 05
   Preserve Evidence Before Remediation

   Capture system event logs, encryption logs, configuration backups, and, where possible, forensic images of each appliance before upgrading or reconfiguring it, since remediation can overwrite the artifacts needed to establish whether and when a device was compromised.
6. 06
   Hunt for Published Indicators

   Search FortiMail logs and network telemetry for connections to the IP addresses listed in the IoC section. Review system event logs for cron entries running /bin/sh as root with references to /migadmin, administrator logouts recorded from a null interface, and archive accounts such as archive234 configured with a remote destination, and review encryption logs for IBE decrypter BufferException errors reporting invalid Base64 encoding at position 0 alongside failed logins by wildcard internal users.
7. 07
   Remove Rogue Configuration and Rotate Credentials

   Audit archive account settings and delete any account that sends archives to an unrecognized remote server, rotate administrator credentials, review all administrative accounts for unauthorized changes, and treat any mail archived to attacker infrastructure as exposed. Where compromise is confirmed, rebuild the appliance from a known-good image rather than relying on the upgrade alone.
8. 08
   Continuously Monitor Edge Appliances

   Forward FortiMail system, administrative, and encryption logs to a central SIEM, and alert on changes to archiving configuration, scheduled tasks, and administrator sessions, as well as on outbound connections from the mail gateway to unfamiliar hosts.

Indicators of Compromise (IoCs)

MITRE ATT&CK TTPs

References & Patch Links

Patch links

• https://fortiguard.fortinet.com/psirt/FG-IR-26-175

References

• https://fortiguard.fortinet.com/psirt/FG-IR-26-175
• https://watchtowr.com/intelligence/fortinet-fortimail-cve-2026-104286-faq/
• https://ccb.belgium.be/advisories/warning-actively-exploited-fortimail-vulnerability-patch-immediately