Vulnerabilities
Critical Fortinet FortiMail Flaw Actively Exploited: Unauthenticated Attackers Can Write Files
A serious vulnerability in Fortinet FortiMail lets attackers write files to affected systems. CISA says it is being exploited and urges urgent action.
Ross GrantUpdated 3 min read
The short version
A serious flaw in Fortinet's FortiMail email security product lets attackers write files to the system without logging in. This could let them take over the device or install malware. The US government says attackers are already using this flaw and urges organisations to fix or protect their systems quickly.
What happened?
CISA added a critical Fortinet FortiMail vulnerability (CVE-2026-104286) to its Known Exploited Vulnerabilities catalogue on 1 October 2026. The flaw allows unauthenticated attackers to write files on affected systems. Fortinet has confirmed the issue and provided mitigation advice. Exploitation is ongoing.
What is the FortiMail vulnerability?
A critical security flaw has been found in Fortinet's FortiMail, an email security product used by many organisations. The vulnerability, tracked as CVE-2026-104286, allows attackers who are not logged in (unauthenticated) to write files anywhere on the system. This can let them take control of the device or install malicious software. The flaw is a type of path traversal vulnerability, which means an attacker can trick the system into saving files in places it should not allow. It also involves improper handling of special characters (NULL bytes) in file paths. CISA (opens in a new tab) added this flaw to its Known Exploited Vulnerabilities (KEV) catalogue on 1 October 2026, confirming that attackers are already using it in real-world attacks.
Who is affected and what versions are vulnerable?
The flaw affects several versions of FortiMail:
- 8.0.0 through 8.0.1
- 7.6.0 through 7.6.6
- 7.4.0 through 7.4.8
- 7.2.0 through 7.2.9
Users of these versions are at risk until they upgrade to the fixed releases. Fortinet has said that updates are coming for each affected branch. In the meantime, it has provided workarounds to reduce risk. The Hacker News (opens in a new tab) reports that Fortinet recommends disabling the IBE (Identity-Based Encryption) feature and restricting access to the management interface from the internet.
How are attackers exploiting the flaw?
Attackers use specially crafted HTTP or HTTPS requests to exploit the vulnerability. By manipulating file paths and using special characters, they can write files to locations on the FortiMail system that should be protected. This can let them install malware, create backdoors, or disrupt email services. No authentication is needed, so any attacker who can reach the device over the network could try to exploit it. CISA says this kind of vulnerability is a frequent entry point for cybercriminals and poses a significant risk, especially to organisations that expose FortiMail to the internet.
What has been done and what should you do?
CISA has told US federal agencies to patch or apply workarounds by 4 October 2026. While this deadline is for government, CISA urges all organisations to act quickly. Fortinet has published mitigation steps and is preparing updates. If you run FortiMail, you should:
- Check your version and apply the latest updates as soon as they are available.
- Disable the IBE feature if you use it.
- Restrict management access to trusted networks only.
- Monitor for signs of compromise, as attackers may have already exploited the flaw.
What happens next?
Organisations should follow CISA’s and Fortinet’s advice to secure their systems. If you cannot patch immediately, apply the workarounds and check your logs for unusual activity. CISA’s inclusion of this flaw in the KEV catalogue means it is a high priority for defenders. For organisations in regulated sectors, failure to act could lead to regulatory scrutiny or fines if customer data is compromised. The situation may develop as more details about attacks or victims emerge.
Claimed vs confirmed
- Confirmed
The vulnerability is being actively exploited in the wild.
CISA and Fortinet have both confirmed that attackers are exploiting CVE-2026-104286.
The impact
- Money
- Organisations that fail to patch could face costs from incident response, possible data breach fines, and downtime. Under GDPR, fines can reach up to €20m or 4% of global turnover if personal data is compromised.
- Reputation
- A breach of email security can damage trust, especially if attackers gain access to sensitive communications or use the system to launch further attacks.
- Customers
- Customers of affected organisations could have their emails intercepted or their data exposed. Users should be alert for suspicious messages and follow any advice from their provider.
Why it matters
Organisations using FortiMail could have their email security compromised and their systems taken over. Attackers do not need a password, so exposed systems are at high risk. Fast action is needed to prevent damage or data loss.
How does it work?
The vulnerability is a path traversal and improper neutralisation of NULL byte flaw. Attackers can send crafted HTTP or HTTPS requests to write files anywhere on the system, without needing to log in. This can let them take control of the device or install malware.
Key points
- A critical FortiMail flaw lets attackers write files without logging in.
- CISA confirms active exploitation and urges urgent action.
- Affected versions include 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8, and 7.2.0–7.2.9.
- Mitigations include disabling IBE and restricting management access.
- Organisations should patch or apply workarounds and check for compromise.
Sources
CISA
Government
The Hacker News
Reference
