# Fortinet FortiMail critical path traversal flaw CVE-2026-104286 (FG-IR-26-175) exploited in zero-day attacks

> Fortinet disclosed CVE-2026-104286 (CVSS 9.8), a path traversal / NULL byte neutralization flaw in the FortiMail management interface that lets unauthenticated attackers write arbitrary files via crafted HTTP/HTTPS requests. Fortinet confirmed zero-day exploitation and CISA added the CVE to the KEV catalog with a federal remediation deadline of 2026-10-04.

- **Published:** 2026-10-01T00:00:00Z
- **Last reviewed:** 2026-10-10T16:23:50.378Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2830
- **ID:** TL-2026-2830
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** ZERO_DAY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-104286

## Description

CVE-2026-104286 (Fortinet PSIRT FG-IR-26-175) is a combination of CWE-22 (path traversal) and CWE-158 (improper neutralization of NULL byte or NUL character) in the FortiMail management interface. An unauthenticated remote attacker can write arbitrary files on the underlying system through crafted HTTP or HTTPS requests. The CVSS v3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); Fortinet's temporal vector is E:P/RL:O/RC:C. NVD (published 2026-10-01 20:17 UTC) marks exploitation as active, the flaw as automatable, and technical impact as total.

Fortinet states the flaw is exploited in the wild as a zero-day. The advisory credits Gwendal Guegniaud of the Fortinet Product Security team, so the issue was found internally. The advisory lists two source IPs associated with the attacks (79.141.169.187 and 45.129.0.192) and a set of files added or modified on compromised appliances: /data/lib/liblog.so, /data/etc/ld.so.preload, /bin/smit, /data/bin/webconsole, /data/bin/mailservice, /data/etc/httpd.conf and /data/migadmin.tar.gz (SHA-256 hashes recorded in the IOC list). The combination of an added shared library, an added ld.so.preload entry, a modified system binary and a modified web server configuration indicates that the arbitrary file write was used to implant persistent, preloaded code on the appliance.

BleepingComputer additionally reports that compromised systems showed archive account configurations pointing to 79.141.169.187 for remote data exfiltration via the /uploads directory, i.e. the appliance's mail archiving function was reconfigured to ship data to attacker infrastructure. The advisory does not attribute the activity to a named actor, name a malware family, or describe the payload's function; none is asserted here. CISA lists known ransomware campaign use as Unknown. BeaconBeagle returned 404 (no record) for 79.141.169.187.

Affected versions per Fortinet: FortiMail 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8 and 7.2.0-7.2.9. The NVD CPE data additionally spans 7.0.0-7.0.9. Fixed releases are 8.0.2, 7.6.7 and 7.4.9; BleepingComputer describes them as pending/upcoming, while the PSIRT table lists them as the fixed versions. FortiMail 7.2 users must migrate to 7.4 or later. Workarounds are to disable the IBE (identity-based encryption) feature (config system encryption ibe / set status disable) and to restrict management interface access to trusted private networks, with no Internet-facing management exposure. CISA added the CVE to the KEV catalog on 2026-10-01 with a due date of 2026-10-04 and directs agencies to apply vendor mitigations per BOD 26-04 or discontinue use of the product if mitigations are unavailable; BleepingComputer notes agencies must perform forensic triage and mitigation. Fortinet says it is communicating with relevant government organizations, including CISA.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1574.006 Dynamic Linker Hijacking
- T1574.006 Dynamic Linker Hijacking
- T1554 Compromise Host Software Binary
- T1505 Server Software Component
- T1036.005 Match Legitimate Resource Name or Location
- T1114 Email Collection
- T1020 Automated Exfiltration
- T1053.003 Cron
- T1059.004 Unix Shell
- T1114.003 Email Forwarding Rule
- T1136.001 Create Account: Local Account
- T1105 Ingress Tool Transfer
- T1048 Exfiltration Over Alternative Protocol

## Sources

- [Fortinet warns of critical FortiMail flaw exploited in zero-day attacks](https://www.bleepingcomputer.com/news/security/fortinet-warns-of-critical-fortimail-flaw-exploited-in-zero-day-attacks/)
- [Fortinet PSIRT FG-IR-26-175](https://fortiguard.fortinet.com/psirt/FG-IR-26-175)
- [NVD CVE-2026-104286 record](https://nvd.nist.gov/vuln/detail/CVE-2026-104286)
- [NVD CVE API record for CVE-2026-104286](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-104286)
- [CISA KEV catalog entry for CVE-2026-104286](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104286)
- [CISA Known Exploited Vulnerabilities JSON feed](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2830