Fortinet FortiMail: critical RCE CVE-2026-104286 exploited

On 1 October 2026 Fortinet published bulletin FG-IR-26-175 about a critical vulnerability in FortiMail, its email security gateway. The vulnerability, CVE-2026-104286, has a CVSS 3.1 score of 9.8 and allows a remote, unauthenticated attacker to write arbitrary files to the system and achieve code execution. Fortinet states that it is already being exploited, and on the same day CISA added it to its Known Exploited Vulnerabilities (KEV) catalog.

In the following days several national CSIRTs issued advisories: in Europe CERT-FR, NCSC-NL, CERT-SE, NCSC-FI and INCIBE-CERT, as well as the Canadian Centre for Cyber Security.

What happened

According to the advisories, the flaw lies in how FortiMail handles file paths. An attacker can send crafted HTTP or HTTPS requests to the appliance and write files outside the intended directory, without any credentials. CERT-FR classifies the risk as remote arbitrary code execution; INCIBE-CERT specifies that writing the files can lead to the execution of unauthorised code or commands and to the compromise of the device.

According to NCSC-FI, successful exploitation can allow an attacker to compromise the FortiMail system, install malicious software and read or tamper with email traffic without authorisation. CERT-FR reports that Fortinet’s bulletin also contains indicators of compromise.

Technical details

• CVE: CVE-2026-104286, CVSS 3.1 9.8 (critical).
• Flaw type: path traversal (CWE-22, improper limitation of a pathname to a restricted directory). NCSC-FI also lists improper neutralisation of the NULL character (CWE-158).
• Vector: network, through HTTP or HTTPS requests, with no authentication. CERT-SE states that the vulnerability affects FortiMail’s management interface.
• Affected versions (according to CERT-SE, NCSC-FI and INCIBE-CERT):
  • FortiMail 8.0 from 8.0.0 to 8.0.1;
  • FortiMail 7.6 from 7.6.0 to 7.6.6;
  • FortiMail 7.4 from 7.4.0 to 7.4.8;
  • FortiMail 7.2 from 7.2.0 to 7.2.9.
• Fixed versions: 8.0.2, 7.6.7 and 7.4.9 or later. No fix is planned for the 7.2 branch: it must be migrated to the 7.4 branch, to 7.4.9 or later.
• FortiMail Cloud: according to INCIBE-CERT, Fortinet fixed it on 5 October 2026 and customers do not need to take any action.
• Exploitation: confirmed by Fortinet and CISA. For CISA, use in ransomware campaigns is currently unknown. The deadline set for US federal agencies was 4 October.
• MITRE ATT&CK: exploiting an exposed service corresponds to T1190 (Exploit Public-Facing Application).

A note on dates: CERT-FR’s advisory of 2 October listed the fixed versions as upcoming, while INCIBE-CERT’s advisory of 8 October tells users to update to these versions. Before planning the work, check Fortinet’s bulletin to see which builds are available for your branch.

How the agencies rate it

The agencies agree on the severity, with different nuances. NCSC-NL rated its advisory (NCSC-2026-0398) as M/H: medium probability and high damage. CERT-SE and NCSC-FI describe it as a critical, actively exploited vulnerability, and INCIBE-CERT gives it the highest importance level on its scale (5, critical).

Impact for European and Italian companies

FortiMail is an email security gateway: the organisation’s messages pass through it. This is why, as NCSC-FI points out, a compromised appliance is not just a system in the attacker’s hands, but also access to the content of the mail and the ability to alter it. Exploitation requires no credentials: all that matters is whether the vulnerable interface can be reached.

For entities covered by NIS2, the compromise of the email gateway is an incident to assess for notification to the national CSIRT, which in Italy is ACN’s CSIRT Italia. The same applies to healthcare organisations, where email often carries personal and clinical data.

What to do now

1. Inventory: identify all FortiMail appliances, physical and virtual, and the version installed on each one.
2. Update: bring the 8.0 branch to 8.0.2, 7.6 to 7.6.7 and 7.4 to 7.4.9, or to later versions. Appliances on the 7.2 branch must be migrated to 7.4.9 or later.
3. If you cannot update right away: Fortinet recommends disabling the IBE (Identity-Based Encryption) feature. Alternatively, block Internet access to the management interface and allow it only from trusted internal networks; INCIBE-CERT also lists the webmail interface among those to restrict to trusted networks.
4. Look for signs of compromise: check the appliances against the indicators of compromise published by Fortinet in bulletin FG-IR-26-175. CERT-SE recommends looking for anomalous behaviour following the vendor’s guidance, reviewing logs from the last 3 months and checking cron jobs for suspicious scripts.
5. If you find traces: treat the appliance as compromised, follow Fortinet’s guidance and assess the notification obligations that apply to your organisation.

How ARXDOME helps

ARX Expose shows which services your company exposes on the Internet, which products are recognised on them and which have known vulnerabilities: it helps you find out whether a management interface can be reached from outside. ARX Sentry collects the logs of firewalls and other network devices in a central collector, so anomalous access and connections stay in front of the analysts. With ARX Horizon you can look up vulnerability details and search for indicators of compromise from the portal.

Last updated: 8 October 2026