Fortinet warned on October 1 that attackers had used the email security flaw to write files without logging in. Administrators can check for signs of compromise and use workarounds while checking for fixes.
Fortinet confirmed that attackers exploited a critical flaw in FortiMail, its email security platform. The flaw, CVE-2026-104286, can let someone write files to an affected system through its web interface without logging in. Fortinet warned customers on October 1; Eclypsium also highlighted the flaw in its October report on infrastructure vulnerabilities.
Fortinet said specially crafted web requests can exploit a path-traversal flaw, which lets a request reach outside its intended file location, together with improper handling of null characters. The result can be an arbitrary file write on the FortiMail system. Writing to certain locations could let an attacker run code or commands on it.
Fortinet’s October 1 guidance identified these affected versions and routes to a fix:
| Branch | Affected versions | Fix guidance on October 1 |
|---|---|---|
| 8.0 | 8.0.0–8.0.1 | 8.0.2 listed as upcoming |
| 7.6 | 7.6.0–7.6.6 | 7.6.7 listed as upcoming |
| 7.4 | 7.4.0–7.4.8 | 7.4.9 listed as upcoming |
| 7.2 | 7.2.0–7.2.9 |
Attackers can write files without logging in, potentially enabling code execution. Some fixes remain pending, and workarounds do not remove an existing compromise.
2 min
| Upgrade to a fixed 7.4 branch or later |
Fortinet advised administrators to disable Identity Based Encryption support if they do not need it. As another workaround, they can keep FortiMail’s management interface off the internet and restrict access to trusted private networks. These steps reduce exposure but do not remove files or mechanisms an attacker may already have planted.
Fortinet published signs administrators can check for, including suspicious files, configuration changes and log entries. The US Cybersecurity and Infrastructure Security Agency added the flaw to its catalog of known exploited vulnerabilities on October 1 and required affected federal civilian agencies to carry out forensic checks and mitigate it by October 4.
In its October 28 coverage, BleepingComputer said Eclypsium’s October InfraTrust Pulse tracked 133 new advisories across 18 vendors from September 18 to October 14. Sixteen of those advisories included flaws listed as exploited in the US agency’s catalog, among them the FortiMail flaw.
Fortinet had not disclosed by October 1 when the FortiMail attacks began, who carried them out or how many systems were compromised. Administrators on affected branches can check for signs of an earlier attack and whether Fortinet has released the fixes it listed as upcoming on October 1.
