Critical FortiMail Zero-Day Exploited Before Fortinet Has a Patch

Fortinet is warning customers that a critical, unpatched vulnerability in its FortiMail email security appliances is already being exploited by attackers, and the company has not yet shipped a fix for most of the affected versions. The flaw, tracked as CVE-2026-104286, carries the maximum-severity CVSS score of 9.8 and lets an attacker write files onto a vulnerable device without ever logging in.

FortiMail is Fortinet’s email security product, used by organizations to filter spam, phishing attempts, and malware out of incoming mail. Because it sits directly in an organization’s email flow, a compromised FortiMail appliance gives an attacker a foothold with visibility into internal communications and a launchpad for further attacks on the network.

How the flaw works

According to Fortinet’s own advisory, the vulnerability combines two separate weaknesses: a path traversal bug, where the software fails to properly restrict file paths to the folders they are supposed to be confined to, and a flaw in how the system handles null byte characters in those paths. Put simply, an attacker can send a specially crafted web request to FortiMail’s management interface and trick the system into writing a file somewhere it should not be able to reach, without supplying any username or password first.

Writing an arbitrary file to the right location on a server is often enough to let an attacker run their own code on it. Fortinet has not published full details of how the exploit chain reaches code execution, but the practical effect is the same: a device that should only be filtering mail can end up fully under someone else’s control.

Already under attack

Fortinet says the vulnerability is being exploited in the wild, and that its investigators have already found malicious files planted on compromised FortiMail systems, including files named liblog.so, webconsole, and mailservice placed in the device’s data directory. The company has also published two IP addresses it has tied to the attack activity. Fortinet credits Gwendal Guégniaud of its own Product Security team with discovering the issue, and the advisory was published on October 1, 2026.

The affected versions span four separate release branches: FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9. Fortinet has listed fixed versions, 7.4.9, 7.6.7, and 8.0.2, as upcoming, but as of publication those updates had not been released. Until they are, Fortinet is telling customers to disable the Identity Based Encryption feature if they do not need it, restrict access to the FortiMail management interface to trusted internal networks only, and check their systems for signs of compromise. Customers still running the 7.2 branch are advised to upgrade to 7.4 or later, since that branch will not receive its own fix.

A tight deadline for US agencies

The US Cybersecurity and Infrastructure Security Agency added CVE-2026-104286 to its Known Exploited Vulnerabilities catalog on October 1. That listing requires US federal civilian agencies to complete forensic checks and apply mitigations by October 4, 2026, a four-day window that reflects how seriously the agency is treating active exploitation of an unauthenticated, unpatched bug. While the KEV deadline is only binding on federal agencies, security teams at any organization running FortiMail should treat it as a strong signal to act now rather than wait for a patch.

Fortinet has a recent history of its products being targeted by attackers before fixes are available. Security teams managing FortiMail deployments are advised to review Fortinet’s advisory directly and apply the recommended mitigations immediately, rather than waiting for the permanent patch.

Source: BleepingComputer, “Fortinet warns of critical FortiMail flaw exploited in zero-day attacks”, with additional reporting from The Hacker News and The Register.