FortiMail Zero-Day CVE-2026-104286 — Unauthenticated Path Traversal Now KEV

Fortinet published advisory FG-IR-26-175 on October 1 confirming that CVE-2026-104286 — a path traversal flaw in FortiMail — is actively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities catalog the same day, giving federal agencies until October 4 to remediate.

That’s a 48-hour clock from KEV listing. Most organizations aren’t federal; they’ll get the memo later.

What It Does

An unauthenticated attacker sends a crafted HTTP or HTTPS request that tricks FortiMail into writing a file outside its intended directory. From there, the attacker can place a binary on the underlying system and execute it — full control of the mail gateway.

No login credentials required. No user interaction. Network attack vector.

Affected Versions

All supported branches, depending on how current the install is:

Fortinet hasn’t released final patches yet — only the workaround and advisory. The 7.2 branch gets no direct patch; migrate to 7.4.

The Workaround

Disable Identity-Based Encryption (IBE):

config system encryption ibe
set status disable
end

Fortinet’s Product Security team (Gwendal Guégniaud) found the flaw internally while resolving a support case. The IBE code path is where the vulnerability lives. Disabling IBE closes the exploited code path.

Fortinet also recommends restricting the management interface to trusted private networks if internet exposure is a concern.

Indicators of Compromise

Fortinet reported these file modifications from in-the-wild exploitation:

CISA hasn’t flagged this entry as ransomware-linked yet. But a mail gateway with arbitrary code execution is ransomware-adjacent by nature — you’re sitting on credentials, internal mail flow, and often a jump point to AD or file shares.

Why It Matters

This is a textbook perimeter-attack profile:

• Unauthenticated from the network
• Path traversal on an email appliance (not a web server — mail gateways get less scrutiny)
• IBE-specific, meaning orgs that don’t use IBE have a near-zero-day mitigation
• KEV-listed with a tight remediation window
• No final patch yet — workaround is your only defense until vendor releases

The pattern here isn’t new. Perimeter appliances (NetScaler, FortiMail, Palo Alto, Cisco) are the highest-leverage targets because they sit between untrusted traffic and internal systems. A successful compromise there touches more assets than a web app vuln in any given org.

What to Do

1. Check your FortiMail inventory — branch version, IBE status, management interface exposure.
2. Disable IBE on all appliances before patches drop.
3. Restrict management interface to trusted networks.
4. Verify workaround effectiveness — check that /data/lib/liblog.so wasn’t modified by the exploit.
5. Patch when 8.0.2/7.6.7/7.4.9 ship — Fortinet’s advisory says “upcoming,” which in Fortinet-speak usually means within days.

Sources

• Fortinet PSIRT FG-IR-26-175
• CISA KEV Addition — Oct 1, 2026
• NVD — CVE-2026-104286
• watchTowr FAQ