CISA put FortiMail on KEV. The fixed builds are still marked upcoming.

CVE-2026-104286 is unauthenticated arbitrary file write on FortiMail. There is no firmware to install. CISA due date is 4 October.

RWP Ventures · 2026-10-02 · event 2026-10-01 · 13 min read · priority 9.2

The product is Fortinet FortiMail. The bug is unauthenticated arbitrary file write on the underlying system through crafted HTTP or HTTPS. Fortinet’s CNA score is 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CWE-22 path traversal plus CWE-158 NULL-byte handling). Component is the GUI. Attack type is unauthenticated. Fortinet’s impact line is execute unauthorized code or commands. Virtual patch: No.

Do not collapse four facts.

1. There is no firmware to install on 8.0, 7.6, or 7.4. Advisory FG-IR-26-175 lists 8.0.2, 7.6.7, and 7.4.9 as upcoming. 7.2.0 through 7.2.9 must migrate to the 7.4 branch or above — into a train that is itself still waiting on 7.4.9. A change ticket that says “upgrade to the fixed release” is currently a wait, not a close.
2. The workaround is not the patch. Fortinet’s two published delays: disable Identity-Based Encryption (config system encryption ibe / set status disable) or pull the management interface off the internet / restrict it to a trusted private network. Neither evicts an attacker who already wrote files. CISA’s forensic-triage language is Yes. Hunt, then constrain, then wait for the ISO.
3. A scanner CPE can lie about who is in. The Fortinet table says 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8, 7.2.0–7.2.9. NVD’s CNA product list, retrieved 2 October, still showed 7.6 through 7.6.5, 7.4 through 7.4.6, and a 7.0.0–7.0.9 range the HTML table does not name. Inventory against FG-IR-26-175, not against a cached CPE. Treat 7.0 as UNKNOWN pending Fortinet, not as cleared.
4. Yesterday’s SD-WAN clock did not pause. Catalog 2026.09.30 added Cisco CVE-2026-76504 (due 3 October). Catalog 2026.09.29 added Apple CVE-2026-86950 (due today, 2 October). NetScaler CVE-2026-88771 / 88772 were due 30 September. Those tickets stay open. The new operational ticket is the mail gateway.

What happened

Thursday 1 October, Fortinet published FG-IR-26-175. Same day, CISA put the CVE on KEV.

Fortinet’s sentence: path traversal plus improper neutralization of a NULL byte or NULL character may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS. The advisory is explicit that this has been reported to be exploited in the wild. Known Exploited: Yes. Discovered internally by Gwendal Guégniaud of Fortinet Product Security. Fortinet told BleepingComputer it is coordinating the content with government organizations, including CISA. The advisory does not name a customer, a count, a first-seen date, or a cluster.

The published workarounds:

config system encryption ibe
set status disable
end

Alternatively: disable internet access to the FortiMail management interface, or limit it to a trusted private network.

Fortinet published compromise indicators. They are hunt artifacts, not a public exploit.

Added or modified files (hashes as Fortinet printed them):

IPs in the advisory: 79.141.169.187, 45.129.0.192. Do not treat those two as the campaign. They are the addresses Fortinet associated with the observed activity.

Log leads Fortinet printed:

• A cron/debug line with (root) CMD (/bin/sh -c 'O=/migadmin ...
• User admin logged out from (null).
• Config add of archive account archive234, destination remote, remote-ip[79.141.169.187], remote-directory[/uploads], from CLI as admin.
• An IBE decrypt exception: invalid Base64 at position 0, character 0x2a.
• Failed login for an internal user pattern *@domain.tld.

A match is a lead. Fortinet did not say every IBE Base64 error is exploitation.

Why it matters

FortiMail sits on inbound and outbound mail: spam, malware, encryption, journaling, and often the last appliance that sees a message before Exchange, Microsoft 365, or Google. Unauthenticated file write on that box is not “a web CVE on a GUI.” It is a path to the mail plane — stored messages, archive accounts, credentials the gateway holds, and any trust the rest of the estate places in that host.

Three operational lies are now in the ticket.

1. “We will take the fixed build in the next window.” Incomplete. On 1–2 October the fixed builds were upcoming. BOD 26-04 still wants FCEB to check whether the actor was on the box. An ISO that does not exist cannot close a KEV row that is due 4 October.
2. “Management is not internet-facing, so we can wait.” Reachability of the GUI is the exploit precondition Fortinet described. If that interface is reachable from an untrusted network, the file-write applies. SMTP exposure is a separate question; do not use “the MX is public, the GUI is not” as a substitute for actually verifying the management ACL. The IBE disable is the other published delay — it is an operational trade, not a firmware bump.
3. “Arbitrary file write is not RCE.” Fortinet’s own impact field is execute unauthorized code or commands. The IoC set includes /data/etc/ld.so.preload (dynamic-linker hijack), added binaries under /data/bin/, a modified httpd.conf, and an archive account pointed at a remote IP. That is persistence and staging language. It is not a claim that every unpatched FortiMail already has those files.

A FortiMail that also journals industrial or safety-system mail is still an IT mail-gateway compromise until evidence shows process impact. None is in this record.

Who / what is affected

FortiGate, FortiOS SSL-VPN, FortiVoice, and FortiClient EMS are not this CVE. Do not collapse last year’s FortiVoice stack overflow (CVE-2025-32756) or this year’s FortiOS / EMS KEVs onto CVE-2026-104286.

Technical context

RWP is not reproducing request paths, NULL-byte encodings, or write locations. Fortinet’s published defender cut is enough: the GUI mishandles a pathname and a NULL; an unauthenticated HTTP or HTTPS request writes a file on the appliance.

What to hunt, from Fortinet’s published guidance — files, configs, and logs, not an exploit path:

• Presence of the added paths above, especially /data/etc/ld.so.preload, /data/lib/liblog.so, /data/bin/webconsole, /data/bin/mailservice.
• Unexpected modification of /bin/smit, /data/etc/httpd.conf, /data/migadmin.tar.gz.
• Archive accounts that did not exist last week, especially names like archive234, remote destinations, or /uploads paths.
• Admin CLI sessions from (null), unexpected admin logouts, cron lines touching /migadmin.
• Egress from the FortiMail management or data plane to 79.141.169.187 or 45.129.0.192 — and to any other new remote archive host. Two IPs are not a blocklist strategy.
• IBE still enabled on boxes whose management GUI is reachable from untrusted networks.

ATT&CK mapping for the ticket, not a kill chain we ran:

No public proof-of-concept is in this assessment. Feedly’s 1 October note said analyzed URLs were non-exploitable; that is not evidence the in-the-wild write did not happen. Fortinet and CISA already said it did.

Threat / exploitation status

Confidence on the vulnerability, the KEV clock, the “upcoming” floors, and the no-virtual-patch sentence: high. Confidence on actor, victim count, and how far the file write was taken past persistence: low. Confidence that every FortiMail with IBE enabled is already compromised: low — reachability of the GUI is the precondition Fortinet described.

What defenders should do

1. Inventory every FortiMail — physical, VM, HA peer, lab, DR, hosted. Record the running version against FG-IR-26-175, not against a scanner CPE that still stops at 7.4.6 / 7.6.5. If you run 7.0, ask Fortinet; do not write “not in scope” from NVD silence or from NVD inclusion alone.
2. If the management GUI is reachable from an untrusted network, treat that as the exploit condition. Pull it behind a jump host / management subnet today. That is workaround two. It does not replace hunting.
3. Decide the IBE trade explicitly. If the estate does not need Identity-Based Encryption, disable it with the published CLI. If it does, do not disable it as a silent “patch.” Constrain the GUI and hunt; document the residual.
4. Preserve, then hunt, then constrain. Snapshot configs and logs off-box before you reboot or image. Check the seven paths and hashes. Check archive-account config. Check ld.so.preload. Check admin CLI from (null). BOD 26-04: a later ISO can destroy the evidence. Open a Fortinet support case with CVE-2026-104286 / FG-IR-26-175 in the title if the files or archive account are ugly.
5. If you find the IoCs: isolate the gateway, freeze mail-flow changes, rotate. Admin and operator passwords, API tokens, LDAP/SMTP credentials the box stores, archive-account secrets, and any trust downstream mail systems placed in that host. Do not assume a clean GUI means a clean /data. Rebuild from known-good firmware when Fortinet ships it; do not “clean” ld.so.preload and return the box to MX duty.
6. When 8.0.2 / 7.6.7 / 7.4.9 actually exist, install them. Until then the KEV row is a mitigation-and-triage clock, not a patch clock. 7.2 does not get a 7.2.10 in this bulletin; the answer is a branch move into 7.4, which is still waiting on 7.4.9.
7. Keep the rest of this window on the board. Apple CVE-2026-86950 is KEV, due today, 2 October. Cisco SD-WAN Manager CVE-2026-76504 is KEV, due tomorrow, 3 October; [yesterday’s assessment](/posts/2026-10-01-cisco-sdwan-manager-cve-2026-76504-kev/) still applies. NetScaler 88771/88772 were due 30 September. The mail gateway is today’s interrupt; those clocks did not pause.

RWP assessment

Score 9.2.

Highest-leverage development since yesterday’s SD-WAN hunt is a new KEV row on the box that inspects mail: unauthenticated file write, no virtual patch, no firmware, forensic triage Yes, due 4 October, and IoCs that already look like persistence (ld.so.preload, added binaries, remote archive). Evidence quality is high: Fortinet PSIRT primary, CISA JSON, NVD/CVE, BleepingComputer corroboration of the CISA coordination statement.

It outranks a second day on Cisco CVE-2026-76504 because yesterday already assessed that API bypass; the due date is tomorrow, not a new exploitation picture, and Cisco at least published floors. It outranks Apple CVE-2026-86950 because that CoreGraphics row has been on KEV since 29 September; today’s due date is a clock, not a new technical finding. It outranks the 1 October CISA ICS batch (ABB PCM600, Johnson Controls EasyIO, CISA Malcolm) because those advisories, as retrieved, did not claim in-the-wild exploitation. It outranks JADEPUFFER / Storm-3168 Azure destruction because Microsoft’s write-up landed 25 September (amplified 28 September), outside this primary window. It outranks municipal ransomware (Vicksburg) because that is a local incident without a new exploited CVE.

What we are not saying: that a named APT owns this CVE; that ransomware is using it; that every IBE decrypt error is exploitation; that 7.0 is confirmed in or out; that a FortiMail journaling an industrial site is confirmed process impact; that disabling IBE remediates a box that already has ld.so.preload.

What we are watching

• Whether Fortinet actually ships 8.0.2 / 7.6.7 / 7.4.9, and whether 7.0 / unlisted SKUs get an explicit in/out.
• Whether Fortinet or CISA names a cluster, a victim sector, or a post-exploit kit beyond the seven files.
• Whether the two published IPs grow into a longer C2 set, or stay as the archive/uploads pair.
• Apple CVE-2026-86950 due today — clock, not this story.
• Cisco CVE-2026-76504 due 3 October — yesterday’s ticket, still open.
• Whether a public PoC appears after the firmware exists. We will not publish one.

Sources

• Fortinet PSIRT — FG-IR-26-175 (CVE-2026-104286)
• CISA — Adds one known exploited vulnerability (1 October 2026)
• CISA — KEV JSON catalog 2026.10.01
• CISA — Known Exploited Vulnerabilities Catalog
• CISA — BOD 26-04
• CVE-2026-104286 · NVD
• BleepingComputer — Fortinet warns of critical FortiMail flaw exploited in zero-day attacks
• SecurityWeek — Exploited Fortinet FortiMail zero-day calls for urgent action
• Help Net Security — Critical FortiMail zero-day exploited in the wild
• watchTowr — Fortinet FortiMail CVE-2026-104286 FAQ