DaystoPatch

FortinetExploited incident

FortiMail unauthenticated arbitrary file write via IBE path traversal

CVE-2026-104286Critical, CVSS 9.8In CISA's Known Exploited Vulnerabilities catalog since 1 Oct 2026

  • Exploited before a fix
FixedFixed for every supported version 4 days after the first public report.
Embed this live clock

Response

Silence
0h
First public report to first vendor statement
Exposure
4d
First public report to first fix
Follow-through
4d
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    CVE record CVE-2026-104286 (CNA: Fortinet)CuratedQuote verified

    "assignerShortName":"fortinet","dateReserved":"2026-10-01T19:12:54.081Z","datePublished":"2026-10-01T19:17:38.938Z"

    Internally discovered; Fortinet's own disclosure (advisory dated 2026-10-01, already stating in-the-wild exploitation) is the first public signal found.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:9f55c14f53dd4772…
    Used in metrics
    Yes
    Dispute this timestamp
    6 more sources for this moment
    Fortinet advisory FG-IR-26-175ClaimedQuote verified1 Oct 2026

    Improper limitation of a pathname to a restricted directory

    The vendor's own disclosure.

    Source
    Fortinet advisory FG-IR-26-175 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:2fa16fb3e2ab9664…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2026-104286)ClaimedQuote verified1 Oct 2026

    Fortinet FortiMail Path Traversal Vulnerability

    Added to CISA's KEV catalog on 2026-10-01.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Fortinet PSIRT FG-IR-26-175 (Wayback snapshot 2026-10-01 23:55 UTC)CuratedQuote verified1 Oct 2026

    This has been reported to be exploited in the wild, customers are urged to apply the workaround below.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:4a815d2f54aebc77…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2026-104286ClaimedQuote verified1 Oct 2026, 19:17 UTC

    An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:9f55c14f53dd4772…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet1 Oct 2026, 20:06 UTC

    Fortinet confirms active exploitation of CVE-2026-104286, a CVSS 9.8 path traversal flaw in FortiMail letting unauthenticated attackers write arbitrary files. CISA added it to KEV today. Affects FortiMail 7.2 through

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet1 Oct 2026, 21:00 UTC

    🚨 [CISA-2026:1001] CISA Adds One Known Exploited Vulnerability to Catalog ( https:// secdb.nttzen.cloud/security-ad visory/detail/CISA-2026:1001 ) CISA has added one new vulnerability to its Known

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    CVE record CVE-2026-104286 (CNA: Fortinet)CuratedQuote verified

    "datePublished":"2026-10-01T19:17:38.938Z"

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:9f55c14f53dd4772…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Fortinet PSIRT FG-IR-26-175CuratedQuote not checked yet1 Oct 2026

    2026-10-01: Initial publication

    Source
    Fortinet PSIRT FG-IR-26-175 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    date onlysame day

    Fortinet PSIRT FG-IR-26-175 (Wayback snapshot 2026-10-01 23:55 UTC)CuratedQuote verified

    Disable the IBE feature support using the following CLI command:

    Workaround in the initial advisory (timeline '2026-10-01: Initial publication'); the GUI variant of the same workaround was added by 2026-10-03.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:4a815d2f54aebc77…
    Used in metrics
    Yes
    Dispute this timestamp

  4. First fix

    date only+4d

    Fortinet PSIRT FG-IR-26-175 (timeline)CuratedQuote verified

    2026-10-05: Solution update

    The initial advisory and the 2026-10-03 snapshot list only 'Upgrade to upcoming 8.0.2 / 7.6.7 / 7.4.9'. The advisory says FortiMail Cloud was remediated 'on oct 05, 2026' with v7.6.7 GA / v8.0.2 GA. Upper bound: fixed builds may have shipped earlier; only the date shown here is evidenced (R2).

    Source
    Fortinet PSIRT FG-IR-26-175 (timeline) vendor advisory update
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:271636573e32bbcd…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date only+4d

    Fortinet PSIRT FG-IR-26-175 (Wayback snapshot 2026-10-14 18:26 UTC)CuratedQuote verified

    2026-10-05: Solution update

    By this snapshot all three branches show released fixes (8.0.2, 7.6.7, 7.4.9) and the only solution change in the timeline is dated 2026-10-05, so all fixes are dated to it. No Wayback capture exists between 2026-10-03 and 2026-10-14 to confirm 7.4.9 shipped the same day. FortiMail 7.2 gets no fix ('Upgrade to branch 7.4 or above') and is not counted.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:861c73371c2171fa…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Fortinet advisory FG-IR-26-175ClaimedQuote verified5 Oct 2026

    2026-10-05: Solution update

    CaveatLast change-log entry that touches fixes; the advisory now lists fixes for every affected branch.

    Source
    Fortinet advisory FG-IR-26-175 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:271636573e32bbcd…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

This advisory changed after publication

  1. FG-IR-26-175

    Recorded in the revision history

    Improper limitation of a pathname to a restricted directory

    Version table: 3 rows added and 3 rows removed. One new row reads "FortiMail 8.0 | 8.0.0 through 8.0.1 | Upgrade to 8.0.2 or above".

    • Fixed versions
    Version table rows
    BeforeFortiMail 8.0 | 8.0.0 through 8.0.1 | Upgrade to upcoming 8.0.2 or above; FortiMail 7.6 | 7.6.0 through 7.6.6 | Upgrade to upcoming 7.6.7 or above; FortiMail 7.4 | 7.4.0 through 7.4.8 | Upgrade to upcoming 7.4.9 or above
    AfterFortiMail 8.0 | 8.0.0 through 8.0.1 | Upgrade to 8.0.2 or above; FortiMail 7.6 | 7.6.0 through 7.6.6 | Upgrade to 7.6.7 or above; FortiMail 7.4 | 7.4.0 through 7.4.8 | Upgrade to 7.4.9 or above
    Earlier version captured 3 Oct 2026, 17:05 UTC: archived copyLater version captured 14 Oct 2026, 18:26 UTC: archived copyRecovered from archived copiesSnapshots 883026fdf5… and bb5101cbfa…Incident page

  2. FG-IR-26-175

    Changed without a revision note

    Improper limitation of a pathname to a restricted directory

    Workaround text changed.

    • Workaround
    Workaround
    BeforeDisable the IBE feature support using the following CLI command: config system encryption ibe set status disable end Alternatively: Disable access to the FortiMail management interface from the internet or limit the access only from trusted private network Indicators of Compromise (IoC): Files: * [A
    AfterDisable the IBE feature support via the GUI ( Encryption -> IBE -> IBE Service 'off' ) or with the following CLI command: config system encryption ibe set status disable end Alternatively: - Disable access to the FortiMail webmail interface from the internet or limit the access only from trusted pri
    Earlier version captured 2 Oct 2026, 08:57 UTC: archived copyLater version captured 3 Oct 2026, 13:10 UTC: archived copyRecovered from archived copiesSnapshots dadc1b25bb… and aecd073f00…Incident page

Send this to your boss

FortiMail email gateways hit by an exploited file-write flaw, fixed Oct 5

Attackers exploited a FortiMail flaw that lets anyone on the internet write files to the appliance, and Fortinet shipped fixes four days after warning about it.

In plain words

Fortinet's FortiMail email security appliance had a serious flaw that attackers were already using to plant files on exposed devices before a fix existed. Fortinet published a temporary workaround on 1 October 2026 and released fixed versions on 5 October 2026. If we run FortiMail ourselves, we need to update to 7.4.9, 7.6.7 or 8.0.2 or later and check it for signs of compromise. FortiMail Cloud customers do not need to act.

What happened and who is affected

What happened

On 1 October 2026 Fortinet disclosed CVE-2026-104286, a path traversal flaw in FortiMail's identity-based encryption (IBE) web feature that lets an unauthenticated attacker write arbitrary files, and said it was already being exploited. Fixed releases were not ready, so Fortinet told customers to turn IBE off. Fixed versions 8.0.2, 7.6.7 and 7.4.9 were added to the advisory on 5 October 2026.

Who is affected

Customer-managed FortiMail 8.0.0 to 8.0.1, 7.6.0 to 7.6.6, 7.4.0 to 7.4.8 and 7.2.0 to 7.2.9. FortiMail Cloud was fixed by Fortinet on 5 October 2026.

CVE-2026-104286. Reviewed 22 Oct 2026. https://daystopatch.com/incidents/fortinet-cve-2026-104286/

Affected products

  • FortiMail
How we built this timeline

Zero-day disclosed by the vendor: the initial advisory (1 Oct 2026) already said 'reported to be exploited in the wild' and offered only 'upcoming' fixed versions. Timeline: 1 Oct 2026 initial publication; 5 Oct 2026 solution update; 7 Oct 2026 FortiMail Cloud fix clarification.

The advisory was edited in place (GUI workaround text added between the 10-01 and 10-03 snapshots). Severity: Fortinet CVSSv3 9.8.

Help Net Security reported the advisory on 2 Oct 2026.

Related

Fortinet report card