CVE-2026-104286: Path Traversal in FortiMail Exploited

Threat Intel
, , ,
1

fortimail
fortimail1200×630 119 KB

Last Updated: 2026-10-02T17:17:53Z

What’s Happening

Various versions of FortiMail have a Path traversal vulnerability (CVE-2026-104286), leading to unauthenticated arbitrary file write actively being exploited in the wild.

Affected Versions:

  • FortiMail 8.0.0 - 8.0.1 => ( No Patch Yet)
  • FortiMail 7.6.0 - 7.6.6 => ( No Patch Yet)
  • FortiMail 7.4.0 - 7.4.8 => ( No Patch Yet)
  • FortiMail 7.2.0 - 7.2.9 => Upgrade to 7.4 branch or later

Actions

Until patches are available, you should:

  • Disable the IBE feature support
    • CLI:
      • config system encryption ibe
        set status disable
        end
    • GUI:
      • Encryption -> IBE -> IBE Service 'off'
  • Disable Access to FortiMail webmail interface or limit access only from trusted private network
  • If behind a WAF, block POST requests to /ibe that contain ../

Observables

There is a STIX bundle available in the advisory

Notes

  • Observables indicate multiple modified and added files
  • Sample logs are provided
    • A cron job related to /migadmin, running /bin/cli admin
    • Admin logout
    • An archive account sending to a remote ip?
    • User login failures
1 Like
2

Thanks for picking this up!

One recommendation I do not follow is

If behind a WAF, block POST requests to /ibe that contain ../

What is the source for this? My current assumption is the affected endpoint is somewhere in e-mail attachment handling or in the Base64 handling of encrypted e-mails (somewhere). I am also not sure if /ibe is the actual vulnerable endpoint.

3

That is their recommendation from the advisory

- Or if there is a Web Application Firewall in front of FortiMail, block POST requests to /ibe that contain ‘../’

1 Like