Summary
CVE-2026-104286 is a critical path traversal vulnerability in Fortinet FortiMail that allows an unauthenticated attacker to write arbitrary files to the underlying system through specially crafted HTTP or HTTPS requests. Fortinet also identified improper handling of NULL bytes as part of the vulnerability. The issue affects FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9. Fortinet reported that the vulnerability was already being exploited in the wild.
Urgent Actions Required
- Disable the IBE service as an immediate workaround while applying the appropriate Fortinet fix.
- Restrict or disable internet-accessible webmail and limit access to trusted private networks where possible.
- Apply the vendor-provided fixes for the affected branch: 8.0.2 or later for the 8.0 branch, 7.6.7 or later for 7.6, and 7.4.9 or later for 7.4. For 7.2, migrate to the 7.4 branch or later.
- Investigate affected appliances for signs of compromise, including the indicators published by Fortinet, particularly unexpected files, suspicious cron activity, and activity involving the reported IP addresses.
- If a WAF is available, block POST requests to /ibe containing ../ as an additional protective measure.
Which Systems Are Vulnerable to CVE-2026-104286?
Technical Overview
- Vulnerability Type:Path Traversal and Improper NULL Byte Handling
- Affected Software/Versions:
- FortiMail 8.0.0 - 8.0.1
- FortiMail 7.6.0 - 7.6.6
- FortiMail 7.4.0 - 7.4.8
- FortiMail 7.2.0 - 7.2.9
- CVSS Vector: v3.1
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
- Patch Availability: Yes, available
How Does the CVE-2026-104286 Exploit Work?
The attack typically follows these steps:
What Causes CVE-2026-104286?
Vulnerability Root Cause:
CVE-2026-104286 results from improper handling of file paths in FortiMail. The flaw combines path traversal with improper handling of NULL bytes, allowing an unauthenticated attacker to manipulate crafted HTTP/HTTPS requests and write arbitrary files to the underlying system.
How Can You Mitigate CVE-2026-104286?
If immediate patching is delayed or not possible:
- Disable the IBE service on the FortiMail appliance.
- Restrict webmail access from the internet or allow it only from trusted private networks.
- Use a WAF rule to block POST requests to /ibe containing ../.
- Monitor the appliance for the published indicators of compromise, including suspicious files, cron activity, and reported IP addresses.
- Investigate potentially compromised appliances and preserve relevant forensic evidence before remediation.
Which Assets and Systems Are at Risk?
- Asset Types Affected:
- FortiMail Appliances - Affected FortiMail versions with the vulnerable file-handling flaw
- Internet-Accessible FortiMail Webmail - FortiMail systems with webmail exposed to untrusted networks
- IBE Services - FortiMail deployments with Identity-Based Encryption enabled
- Business-Critical Systems at Risk:
- Email Security Gateways - FortiMail systems handling inbound and outbound email traffic
- Quarantine and Archive Systems - FortiMail deployments managing stored or archived email
- Exposure Level:
- Internet-Facing FortiMail Systems - Especially systems with webmail or related web access exposed to the internet
- FortiMail Systems with IBE Enabled - The IBE service is the specific feature addressed by Fortinet's workaround
How Can You Detect CVE-2026-104286 Exploitation?
Exploitation Signatures:
Look for suspicious POST requests to /ibe containing ../, particularly on internet-accessible FortiMail systems.
Indicators of Compromise (IOCs/IOAs):
- Connections involving 79.141.169.187 or 45.129.0.192
- Unexpected files such as /data/lib/liblog.so, /data/bin/webconsole, or /data/bin/mailservice
- Changes involving /data/etc/ld.so.preload or /data/etc/httpd.conf
- Unexpected /data/migadmin.tar.gz or activity involving /bin/smit
- Archive account activity involving archive234
Behavioral Indicators:
- Cron activity referencing /migadmin
- Invalid Base64 encoding or failed internal user logins in encryption logs
- Unexpected administrator logout or suspicious remote archive activity
Alerting Strategy:
- Priority: Critical
- Alert on requests matching the reported /ibe path traversal pattern.
- Monitor for connections to the reported malicious IP addresses.
- Alert on unexpected changes to the published FortiMail files and configuration paths.
- Investigate suspicious archive account and /migadmin cron activity.
Remediation & Response
- Incident Response Considerations:
- Restrict affected FortiMail systems from untrusted networks and disable IBE while investigating.
- Check published indicators of compromise, including the reported IP addresses, suspicious files, archive account activity, and /migadmin cron activity.
- Preserve forensic evidence from potentially compromised appliances before remediation.
- Treat confirmed compromised appliances as fully compromised and follow appropriate forensic and containment procedures.
- Rotate credentials, certificates, and API keys if compromise is confirmed.
- After remediation, verify the appliance for remaining suspicious files, configuration changes, and other indicators associated with the observed attacks.
Compliance & Governance Notes
- Audit Trail Requirement:
- Preserve relevant FortiMail logs and forensic evidence when investigating suspected exploitation.
- Record remediation actions and affected FortiMail versions as part of the organization's change and incident records.
- Document findings from checks for the published indicators of compromise, including suspicious files, IP addresses, account activity, and cron activity.
- Policy Alignment:
- Ensure vulnerability management procedures address actively exploited vulnerabilities such as CVE-2026-104286.
- Include internet exposure assessment and forensic investigation when responding to affected FortiMail systems.
- Maintain procedures for containment, evidence preservation, credential rotation, and remediation when compromise is identified.
See How Fidelis Strengthens Network Security with Deep Visibility
-
-
- Detect threats across all ports and protocols
- Gain deeper context with 300+ network metadata attributes
- Inspect network, email, and web traffic
- Strengthen data protection with Network DLP
- Get actionable insights for faster threat detection and response
-
CVSS Breakdown Table
| Metric | Value | Description |
|---|---|---|
| Base Score | 9.8 | Indicates a highly severe vulnerability with significant impact and straightforward remote exploitation |
| Attack Vector | Network | The vulnerability can be exploited remotely through HTTP or HTTPS requests |
| Attack Complexity | Low | Exploitation does not require special conditions beyond sending a crafted request |
| Privileges Required | None | The attacker does not need to authenticate before attempting exploitation |
| User Interaction | None | Exploitation does not depend on action from a user |
| Scope | Unchanged | The impact remains within the security authority of the vulnerable FortiMail component |
| Confidentiality Impact | High | Successful exploitation can expose sensitive information from the affected system |
| Integrity Impact | High | The flaw allows an attacker to write arbitrary files to the underlying system |
| Availability Impact | High | Successful exploitation can significantly affect the availability of the affected system |
References:
