# Critical FortiMail Vulnerability Actively Targeted by Attackers

*Published October 5, 2026*
*Source: [https://cybersecuritynews.com/fortimail-0-day-vulnerability-exploited/](https://cybersecuritynews.com/fortimail-0-day-vulnerability-exploited/)*

## Executive Summary

*This is a Premium edition. The Executive Summary is available to sec-news.ai members —*
*[read it here](https://www.sec-news.ai/news/critical-fortimail-vulnerability-actively-targeted-by-attackers) or [see plans](https://www.sec-news.ai/pricing).*

## Article

Fortinet has issued a warning about a critical zero-day vulnerability in its FortiMail email security systems, tracked as CVE-2026-104286. This flaw, with a severity score of 9.8 on the CVSS scale, allows attackers without login credentials to write files on compromised devices through specially crafted HTTP or HTTPS requests. The vulnerability has been exploited in the wild, prompting Fortinet to urge immediate action.

The issue arises from two combined weaknesses: path traversal and improper handling of NULL bytes. Path traversal allows file paths to escape their intended directories, enabling unauthorized file writes that could compromise the integrity of FortiMail systems. Fortinet has not disclosed details about the attackers or the extent of the impact, and there is no virtual patch available yet.

Fortinet has provided a workaround to disable the IBE feature via the command-line interface. Administrators are also advised to restrict internet access to FortiMail management interfaces or limit it to trusted networks. Fortinet's advisory details the affected versions, which include FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9. Fixes will be available in upcoming releases such as versions 8.0.2, 7.6.7, and 7.4.9.

Organizations are advised to follow Fortinet's guidance on applying workarounds and to monitor for any signs of compromise, such as unexpected account changes or unauthorized outbound connections. The advisory includes file indicators and IP addresses that may signify compromise, such as suspicious activity logged to specific IPs and unexpected cron commands.

In light of this vulnerability, it is crucial for organizations using affected FortiMail versions to act swiftly, apply the recommended workarounds, and remain vigilant for any indicators of compromise.