Fortinet FortiMail: Path traversal allows unauthenticated arbitrary file writes

Summary

Fortinet FortiMail contains a path traversal flaw combined with improper NULL byte handling, which is reachable through the IBE component. An unauthenticated attacker can write arbitrary files on the underlying system by sending crafted HTTP or HTTPS requests, which can lead to unauthorized code or command execution. Fortinet and CISA report active exploitation, and the flaw is listed in CISA's Known Exploited Vulnerabilities catalog.

Affected

• FortiMail 8.0.0 through 8.0.1
• FortiMail 7.6.0 through 7.6.6
• FortiMail 7.4.0 through 7.4.8
• FortiMail 7.2.0 through 7.2.9
• FortiMail 7.0, all versions (per Fortinet advisory)
• FortiMail Cloud was remediated by Fortinet on 5 October 2026 and needs no customer action

Fixed in

• 8.0: 8.0.2 or above
• 7.6: 7.6.7 or above
• 7.4: 7.4.9 or above
• 7.2: upcoming 7.2.10 or above (per Fortinet; availability not confirmed)
• 7.0: Unknown; migrate to a fixed release

Workaround

• Disable the IBE service (GUI: Encryption -> IBE -> IBE Service off, or CLI: config system encryption ibe, set status disable, end)
• Block access to the FortiMail web interface from the internet or limit it to trusted private networks
• If a WAF is in front of FortiMail, block POST requests to /ibe that contain '../'

Exploitation

• Exploited in the wild: confirmed by Fortinet and CISA (added to KEV on 1 October 2026)
• Threat actor attribution: Unknown
• Public proof of concept: Unverified; assume attackers can reproduce the flaw
• Fortinet publishes indicators of compromise in advisory FG-IR-26-175

Our recommendation

• Inventory all FortiMail appliances, including virtual and cloud instances, with their versions.
• Disable IBE if it is not needed and restrict web and management access to trusted networks immediately.
• Check the indicators of compromise in FG-IR-26-175 and review logs; if compromise is suspected, start forensic triage.
• Upgrade to 8.0.2, 7.6.7 or 7.4.9 as applicable and plan a migration away from 7.2 and 7.0.
• Confirm that fixed builds are downloadable on Fortinet's portal before rollout.
• Treat disabling IBE as containment only, not as proof that the system is clean.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (5 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  ShadowForge-Cyber/CVE-2026-104286-POC · techupdate24/fortimail-zero-day-cve-2026-104286 · kh20134/fortimail-cve-2026-104286-response · CompleteTech-Security/fortimail-cve-2026-104286-check · maxprog-svg/CVE-2026-104286

Research sources

• Fortinet PSIRT advisory FG-IR-26-175 fortiguard.fortinet.com
• CISA Known Exploited Vulnerabilities Catalog entry for CVE-2026-104286 www.cisa.gov
• CISA alert: KEV catalog addition for CVE-2026-104286 www.cisa.gov
• watchTowr FAQ on CVE-2026-104286 watchtowr.com
• Tenable CVE-2026-104286 www.tenable.com
• SOCRadar: FortiMail zero-day under active exploitation socradar.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 13:23.