Patch FortiMail now: an exploited path traversal flaw, rated 9.8

If your office runs a FortiMail email security gateway, check its firmware version today. A path traversal flaw lets a remote, unauthenticated attacker write files onto the appliance through specially crafted web requests. Fortinet says it has been exploited in the wild, and CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on October 1, 2026.

The details

• CVE: CVE-2026-104286 (Fortinet advisory FG-IR-26-175)
• Severity: CVSS 9.8, critical. No login or user interaction is needed.
• Exploitation: Fortinet’s advisory says it has been reported exploited, and urges customers to apply the workaround. CISA lists ransomware use as unknown.
• CISA due date: October 4, 2026 for federal agencies. If you serve government or a bank, treat that as your own target.

Fixed versions

FortiMail branch	Affected	Fix
8.0	8.0.0 through 8.0.1	8.0.2 or later
7.6	7.6.0 through 7.6.6	7.6.7 or later
7.4	7.4.0 through 7.4.8	7.4.9 or later
7.2	7.2.0 through 7.2.9	Upgrade to 7.4 or later

Take a configuration backup before upgrading, as you would for any firmware change.

If you can’t patch today

Fortinet’s advisory gives two ways to cut the exposure:

• Disable the IBE feature (FortiMail’s identity-based encryption) from the command line. The advisory has the exact steps.
• Restrict access to the management interface to trusted networks only. A mail gateway’s admin and web interfaces shouldn’t be reachable from the whole internet.

A workaround reduces exposure; it doesn’t replace the upgrade. Patch as soon as you can schedule it.

Check whether you were already hit

Because this was exploited before the advisory went out, patching isn’t the end of the job. CISA’s catalog entry flags forensic triage as required. Fortinet’s advisory lists indicators of compromise: file hashes, suspicious IP addresses, and log patterns such as failed logins and unexpected scheduled jobs. Compare them with your appliance and firewall logs. If you find a match, or you can’t rule it out, take the appliance off the network, preserve its logs, and call your IT provider or incident response contact. Our first-hour guide and incident response checklist cover the basics.

Not sure whether you run FortiMail? Look for a Fortinet mail gateway in front of your mail server, or ask whoever manages your email filtering. Microsoft 365 and Google Workspace mailboxes aren’t FortiMail, though a gateway may sit in front of them.

Sources

• FG-IR-26-175: FortiMail path traversal (Fortinet): CVSS, affected and fixed versions, workarounds, exploitation status, and indicators of compromise
• Known Exploited Vulnerabilities catalog (CISA): CVE-2026-104286 added October 1, 2026, due date October 4, forensic triage and ransomware-use fields