FortiMail CVE-2026-104286: your encrypted-mail portal accepts files from strangers

Call: Patch now. CVE-2026-104286 is a path traversal with a null-byte chaser in FortiMail’s IBE (identity-based encryption) web interface. An unauthenticated attacker can write arbitrary files on the box with a crafted HTTP or HTTPS request. Fortinet says it’s being exploited in the wild and rates it Critical (CVSS 9.8). The advisory went out Oct 1 and the fixed builds were added Oct 5. If this one slipped past you during a busy October, now’s the time.

Fixed in: FortiMail 8.0.2, 7.6.7 and 7.4.9. 7.2 gets no fix, so move to 7.4 or later. FortiMail Cloud was updated by Fortinet on Oct 5, so cloud customers have nothing to do.

Workaround (until you upgrade):

• Turn off IBE: Encryption > IBE > IBE Service off, or config system encryption ibe / set status disable / end.
• Or take the webmail interface off the internet, or limit it to trusted networks.
• Or, if a WAF sits in front of FortiMail, block POST requests to /ibe that contain ../.

Check whether you were hit: Fortinet lists two attacker IPs, 79.141.169.187 and 45.129.0.192. It also lists log patterns: a cron entry running /bin/sh -c 'O=/migadmin ..., a new archive account called archive234 pointed at 79.141.169.187, and IBE “Invalid Base64 Encoding” errors. If you find any of them, treat the box as compromised, not just unpatched.

Sources: FortiGuard FG-IR-26-175 (opens in a new tab)↗⁠.

Sources

• https://fortiguard.fortinet.com/psirt/FG-IR-26-175⁠↗ (opens in a new tab)