Mail gateways sit in an awkward spot: reachable from outside, trusted by everything inside, and rarely on anyone's list of things to look at on a Friday afternoon. The Hacker News reports that Fortinet has now confirmed exploitation of a critical FortiMail flaw, tracked as CVE-2026-104286.
What the bug is
It is a path traversal (CWE-22) combined with a failure to neutralise NULL bytes (CWE-158). In plain terms, a crafted HTTP or HTTPS request can make the appliance write a file wherever the attacker names, without logging in. The CVSS score is 9.8. The issue was reported internally by Gwendal Guégniaud of Fortinet's Product Security team.
Which versions are affected
- FortiMail 8.0.0 to 8.0.1: move to 8.0.2 or later
- FortiMail 7.6.0 to 7.6.6: move to 7.6.7 or later
- FortiMail 7.4.0 to 7.4.8: move to 7.4.9 or later
- FortiMail 7.2.0 to 7.2.9: migrate to the 7.4 branch or newer
Exploitation and the clock
CISA put the flaw in the KEV catalogue on 1 October. Federal civilian agencies must patch or apply the workaround by 4 October, a three-day window that is becoming the norm for edge appliances. You do not need to be a federal agency to take the hint.
Signs someone got there first
The published indicators are specific, which helps. Look for new files at /data/lib/liblog.so, /data/bin/webconsole, /data/bin/mailservice and /data/etc/ld.so.preload, and for changes to /bin/smit, /data/etc/httpd.conf and /data/migadmin.tar.gz. Requests from 79.141.169[.]187 and 45.129.0[.]192 are flagged as malicious. A preload entry is the sort of thing that survives a casual look, so check it deliberately.
If you cannot patch today
- Disable the IBE (identity-based encryption) feature through the CLI, per Fortinet's workaround.
- Restrict management interface access to trusted private networks only.
- Check the files above before you upgrade. Patching removes the hole, not an implant already planted.
- Assume mail routed through a compromised box was readable, and decide whether credentials seen in that mail need rotating.
If you want a second pair of eyes on your perimeter appliances or a patching process that copes with weekend deadlines, email sales@halfteck.com.