top of page

Active Exploitation of Fortinet FortiMail Path Traversal Zero-Day (CVE-2026-104286)

October 12th, 2026

Critical

Our Cyber Threat Intelligence Unit is tracking active exploitation of CVE-2026-104286, a critical zero-day in Fortinet FortiMail (CVSS 9.8). The vulnerability is a path traversal weakness (CWE-22); Fortinet also lists improper neutralization of NULL byte or NULL character (CWE-158). An unauthenticated attacker can write arbitrary files to the underlying system via crafted HTTP or HTTPS requests. Affected versions include FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9. Fortinet reports exploitation in the wild, and CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on October 1, 2026, with a federal remediation due date of October 4, 2026. Fortinet’s advisory and STIX data list IP addresses, file hashes, and log indicators. BleepingComputer maps the hashes to files added or modified on compromised appliances. Fortinet has not disclosed when exploitation began, how many appliances are affected, or who is responsible. Fixes are available in FortiMail 8.0.2, 7.6.7, and 7.4.9. FortiMail Cloud was remediated on October 5, 2026. On-premises customers should upgrade and apply Fortinet’s workarounds until they do.

Technical Details

  • Threat Type: Unauthenticated arbitrary file write (path traversal with NULL byte neutralization failure); zero-day.

  • Severity: Critical.

    • CVSS v3.1 9.8 (published by Fortinet and listed on NVD as a secondary source; NVD has not published its own score as of October 9, 2026).

    • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • CVE ID: CVE-2026-104286 (Fortinet advisory FG-IR-26-175, published October 1, 2026; updated October 5 and 7, 2026).

  • Affected Systems/Products: Fortinet FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9

  • Fixed Versions: FortiMail 8.0.2, 7.6.7, and 7.4.9 or later. FortiMail 7.2 has no in-branch fix; Fortinet directs these customers to the 7.4 branch or above, and since 7.4.0 through 7.4.8 remain affected, the target is 7.4.9 or later. FortiMail Cloud was remediated on October 5, 2026 (v7.6.7 GA or v8.0.2 GA) and needs no customer action.

  • Exploitation Status: Exploited in the wild per Fortinet; listed in the CISA KEV catalog on October 1, 2026 (federal remediation due October 4, 2026). CISA SSVC: exploitation active, automatable yes, technical impact total. Fortinet lists no virtual patch. Log samples in Fortinet’s STIX data are dated July 20, 2026. Fortinet has not said whether they come from victim appliances, so the date does not establish when exploitation began (analyst observation).

  • Discovery: Internally discovered and reported by Gwendal Guégniaud of Fortinet Product Security.


Attack Chain:

  • Initial Access: An unauthenticated attacker sends crafted HTTP or HTTPS requests to the FortiMail web interface. Internet-exposed appliances are at highest risk.

  • Exploitation: Path traversal combined with NULL byte mishandling allows arbitrary file writes outside the intended directory. Fortinet has not published the root cause or exploit details;its WAF workaround references POST requests to /ibe containing ../.

  • Payload Delivery: Fortinet’s STIX data lists hashes for seven files, which BleepingComputer maps to these paths.

    • Added: /data/lib/liblog.so, /data/bin/webconsole, /data/bin/mailservice, /data/etc/ld.so.preload.

    • Modified: /bin/smit, /data/etc/httpd.conf, /data/migadmin.tar.gz.

    • Persistence: /data/etc/ld.so.preload contains /data/lib/liblog.so, loading the added library into processes on the appliance (consistent with MITRE ATT&CK T1574.006; analyst mapping). /data/etc/httpd.conf contains repeated LoadModule FMLcheck_module lines, whereas a normal file has only an Include.

    • Command and Control:Fortinet lists 79.141.169[.]187 and 45.129.0[.]192 as associated with the attacks and does not describe their roles. The first is also the remote destination in the archive account log entry.

    • Post-Exploitation: A root cron job dumps the appliance configuration (echo show | /bin/cli admin) to an HTML file under /migadmin/www/, schedules its deletion after 86400 seconds, and removes its own cron files. An archive account, archive234, is added from the CLI with 79.141.169[.]187 as the remote destination and /uploads as the directory, followed by two archive policies with pattern[*]. This is consistent with mail data being sent to an external server.

Image by ThisisEngineering

Impact

  • Arbitrary File Write and Code Execution: An unauthenticated remote attacker can write arbitrary files. Fortinet lists the impact as execution of unauthorized code or commands.

  • Appliance Integrity: Modified system and configuration files plus new binaries mean the appliance cannot be trusted. Patching does not remove files an attacker already placed (analyst assessment).

  • Configuration Disclosure: The cron job dumps the appliance configuration, which may expose settings and integration details(analyst assessment).

  • Mail Data Exposure: The archive account and policy entries show a path for sending mail data to an external server.

  • Infrastructure Exposure: A compromised mail gateway is a trusted internal asset and a possible foothold into connected environments.

  • Remediation Complexity: FortiMail 7.2 needs a branch upgrade, and Fortinet’s workarounds do not clean an already compromised appliance.

Detection Method

  • File System: Alert on creation of /data/lib/liblog.so, /data/bin/webconsole, /data/bin/mailservice, and /data/etc/ld.so.preload, and on modification of  /bin/smit, /data/etc/httpd.conf, and /data/migadmin.tar.gz. Check whether  ld.so.preload contains /data/lib/liblog.so, whether httpd.conf has repeated LoadModule FMLcheck_module lines, and whether /migadmin/www/.session-*.html files exist. Compare hashes against Section 5.0, and validate offline where possible (analyst recommendation).

  • Web Logs: Review POST requests to /ibe and ../ in request paths (Fortinet’s WAF reference). Also hunt for ..%2F, ..%252F, and %00 (analyst heuristics, not Fortinet-confirmed).

  • System Event Logs: Search for a cron entry beginning (root) CMD (/bin/sh -c 'O=/migadmin, administrator logout from (null), and archive account or policy additions from the CLI with a remote destination (for example archive234, pattern[*]).

  • Encryption Logs: Search for IBE decrypter errors reporting Invalid Base64 Encoding at pos 0. Character=0x2a (or pos 5. Character=0x2d), and failed logins for internal users with wildcard-style names.

  • Network: Monitor outbound connections from FortiMail to 79.141.169[.]187 and 45.129.0[.]192, and review historical firewall, proxy, and NetFlow logs for these addresses from any host.

  • Exposure: Verify through external scanning and firewall review whether the webmail and IBE interfaces are reachable from the internet.

Indicators of Compromise

Type

Indicator

Description

IP Address

79.141.169[.]187

Associated with the attacks by Fortinet; also the remote destination in the archive account log entry

IP Address

45.129.0[.]192

Associated with the attacks by Fortinet

File Path

/data/lib/liblog[.]so

Added on compromised appliances

File Path

/bin/smit

Modified on compromised appliances

File Path

/data/bin/webconsole

Added on compromised appliances

File Path

/data/bin/mailservice

Added on compromised appliances

File Path

/data/etc/httpd.conf

Modified on compromised appliances

File Path

/data/etc/ld[.]so[.]preload

Added on compromised appliances

File Path

/data/migadmin.tar.gz

Modified on compromised appliances

File Path

/migadmin/www/.session-d1e5323276f24a90.html

Output file written by the cron job (appliance configuration dump); deleted by the job after 86400 seconds. The hex identifier may differ per appliance (analyst note)

File Path

/etc/cron.d/cfg-update-d1e5323276f24a90

Cron file removed by the cron job after execution

File Path

/var/spool/cron/.trigger-d1e5323276f24a90

Cron trigger file removed by the cron job after execution

SHA-256

8015f34dc84922b03688399d7f9fe7a00361789f7e420c7e2a2cdb23e75cef84

/data/lib/liblog.so (added)

SHA-256

77324ac428bde86d351fc5fc06f6d64a6bfe737dfb2743df1d4c5ac2418a5b6a

/bin/smit (modified)

SHA-256

7a6cea9f5c9e2e9994d4e3c4da73f86cf5acd05ea5d312c066c9d1dafd69ee38

/data/bin/webconsole (added)

SHA-256

4000276a150a165d3c2537d1e19fb393c4de8333076a16655e28059cae82157b

/data/bin/mailservice (added)

SHA-256

703e97c64e61e41dc3aaba580d82bb2aa7b6a11b54ee6fb467ed5d5a3bffdef5

/data/etc/httpd.conf (modified)

SHA-256

8953ec7960b09f544a880b072ad4e6cfda7a8303f486251d3478dcfdfbac23b6

/data/etc/ld.so.preload (added)

SHA-256

d6fe51c22b91776f4c961ea58bcac5917f15d560a619d7ce726d3d51795609d3

/data/migadmin.tar.gz (modified)

MD5

64c90a00c7fda4d5c7973ed64c25783a

/data/lib/liblog.so (added)

MD5

5241738a3e9988404239e12243f6d35b

/bin/smit (modified)

MD5

ae0ea6502d3fa5f0664bceb73189eb54

/data/bin/webconsole (added)

MD5

f90fa81a5f521d785f2b2f765e3ab897

/data/bin/mailservice (added)

MD5

61af1c4bce1c2eebc8ff689ca5337791

/data/etc/httpd.conf (modified)

MD5

8eb64f25d2a8e18e05aae058629473cf

/data/etc/ld.so.preload (added)

MD5

49a7156a7d043cc8f9f680579db22f86

/data/migadmin.tar.gz (modified)

File Content

/data/etc/ld.so.preload: /data/lib/liblog.so

Preload file referencing the added shared library

File Content

/data/etc/httpd.conf: repeated line LoadModule FMLcheck_module modules/mod_FMLcheck.so

Seven repeated entries in the sample. A normal file contains only: Include /migadmin/etc/httpd.conf

Log Entry (System Event)

type=event subtype=system pri=debug user=system ui=cron msg="(root) CMD (/bin/sh -c 'O=/migadmin/www/.session-d1e5323276f24a90.html; { echo '<!DOCTYPE html><html><head><meta charset=UTF-8><meta name=viewport content='width=device-width,initial-scale=1'><title>.session</title><style>*{margin:0;padding:0;box-sizing:border-box}body{background:#0a0a0a;color:#c0c0c0;font-family:\'Courier New\',monospace;font-size:12px;padding:15px}h2{color:#0f0;border-bottom:1px solid #333;padding-bottom:5px;margin-bottom:10px}.m{color:#0cc;margin:10px 0 5px}.d{color:#888;margin-bottom:15px}pre{white-space:pre-wrap;word-wrap:break-word;line-height:1.4}</style></head><body><h2>Configuration</h2><div class=d>2026-07-20 02:45:34</div><pre>'; echo show | /bin/cli admin 2>&1; echo '</pre></body></html>'; } > '$O'; chmod 644 '$O'; nohup sh -c 'sleep 86400; rm -f $O' >/dev/null 2>&1 & rm -f /etc/cron.d/cfg-update-d1e5323276f24a90 /var/spool/cron/.trigger-d1e5323276f24a90')"

Root cron job dumping the appliance configuration to an HTML file under /migadmin/www/, then removing its cron files. The advisory page truncates this entry; full string from STIX (sample 2026-07-20 08:47:01)

Log Entry (System Event)

type=kevent subtype=admin pri=information user=admin ui=(null) action=logout status=success reason=unknown msg="User admin logged out from (null)."

Administrator logged out from (null). The STIX sample carries log_id=0701014575 and timestamp 2026-07-20 08:47:02.497 (+0200)

Log Entry (System Event)

type=kevent subtype=config pri=information user=admin ui=cli module=unknown submodule=unknown msg="Added 'archive234' to 'archive account' : rotation-size[50]rotation-time[1]rotation-hour[14]destination[remote]remote-ip[79.141.169.187]remote-username[archive234]remote-password[***]remote-directory[/uploads] (user: admin, from: cli)"

Archive account archive234 added from the CLI with a remote destination and /uploads directory

Log Entry (System Event)

type=kevent subtype=config pri=information user=admin ui=cli module=unknown submodule=unknown msg="Added '3' to 'archive policy': account[archive234]type[recipient]pattern[*] (user: admin, from: cli)."

Archive policy added for account archive234 with pattern[*]

Log Entry (System Event)

type=kevent subtype=config pri=information user=admin ui=cli module=unknown submodule=unknown msg="Added '4' to 'archive policy' : account[archive234]pattern[*] (user: admin, from: cli)."

Archive policy added for account archive234 with pattern[*]

Log Entry (Encryption)

FortiMail::IBE::DecrypterMediaIn::DecrypterMediaIn(FortiMail::MediaIn&, const FortiMail::IBE::KeyFinder&, const FortiMail::EmailAddress&, const FortiMail::Buffer&, FortiMail::IBE::DecrypterMediaIn::Version): Caught BufferException(2), BufferImpl.cpp:973, 'Invalid Base64 Encoding at pos 0. Character=0x2a'

IBE decrypter error (Fortinet advisory page)

Log Entry (Encryption)

FortiMail::IBE::DecrypterMediaIn::DecrypterMediaIn(FortiMail::MediaIn&, const FortiMail::IBE::KeyFinder&, const FortiMail::EmailAddress&, const FortiMail::Buffer&, Version): Caught BufferException( 2 ) , BufferImpl.cpp:963, 'Invalid Base64 Encoding at pos 5. Character=0x2d'

IBE decrypter error variant (Fortinet STIX data)

Log Entry (Encryption)

Internal user *@domain.tld failed to log in.

Failed login for an internal user with a wildcard-style name


mix of red, purple, orange, blue bubble shape waves horizontal for cybersecurity and netwo

Recommendations

  • Upgrade to FortiMail 8.0.2, 7.6.7, or 7.4.9 or later. FortiMail 7.2 customers should upgrade to 7.4.9 or later. FortiMail Cloud customers need not act.

  • Until upgraded, disable IBE (GUI: Encryption > IBE > IBE Service off; CLI: config system encryption ibe, set status disable, end) after confirming no business process depends on IBE-encrypted mail (analyst note).

  • Restrict webmail access. Block internet access to the FortiMail webmail interface or restrict it to trusted private networks. Behind a WAF, block POST requests to /ibe containing ../.

  • Check all appliances for the file paths and hashes in Section 5.0 and the log indicators in Sections 4.0 and 5.0. Treat any match as a compromise: isolate the appliance, preserve evidence, and start incident response.

  • For compromised appliances, patching is not enough. Rebuild from a known-good image and rotate credentials and secrets used by the appliance, including administrator and directory integration accounts (analyst recommendation).

  • Block and search the IP addresses. Add both IP addresses to firewall, IPS, and SIEM deny lists, and search firewall, proxy, and NetFlow logs back to at least early July 2026. Fortinet has not disclosed when exploitation began, and its STIX log samples are dated July 20 (analyst recommendation).

  • Restrict outbound connections from FortiMail to required mail relay, DNS, and NTP destinations.

  • Forward logs. Send web access, system event, and encryption logs to the SIEM and retain them for hunting.

Conclusion

CVE-2026-104286 is a critical, unauthenticated path traversal vulnerability (CVSS 9.8) in FortiMail that allows arbitrary file writes and is being exploited in the wild. Indicators show attackers adding binaries and a preload file, modifying system and configuration files, and configuring an archive account with an external destination, consistent with data exfiltration. Organizations should upgrade to fixed releases, apply Fortinet’s workarounds where upgrades are pending, restrict exposure of the webmail and IBE interfaces, and hunt for the published indicators. Treat any appliance showing them as compromised.

bottom of page