CISA KEV Adds Actively Exploited FortiMail CVE-2026-104286: Urgent Patch and Forensic Triage

Path traversal can sound like a minor web bug. This one is much worse. CISA's catalog entry says the FortiMail flaw contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. An attacker who can write arbitrary files on an email security gateway without logging in has a strong foothold on a box that sees much of an organization's mail.

What CISA's catalog entry says​

The KEV entry has the details federal agencies need, and they tell other organizations how urgent this is:

• Weakness classes: Related CWEs: CWE-22| CWE-158. CWE-22 is path traversal. CWE-158 covers improper handling of NULL bytes, a common way to slip past filename checks.
• Ransomware use: Known To Be Used in Ransomware Campaigns? Unknown
• Forensic triage: Forensic triage required per BOD 26-04: Yes
• Deadline: Date Added: 2026-10-01 · Due Date: 2026-10-04

A three-day window is very short by KEV standards. Under Binding Operational Directive 26-04, which CISA issued on June 10, 2026, the label "& forensic triage" means agencies must finish remediation or mitigation within three days and also run a forensic triage on the asset to check whether it was compromised. The directive says an adequate triage follows the Forensic Triage Guidance in its Implementation Guide. In other words, patching alone isn't enough. CISA also wants agencies to check whether attackers got in before the fix.

Section summary: CISA confirms unauthenticated arbitrary file write, a federal deadline of October 4, and mandatory forensic triage for agencies. Ransomware use is listed as unknown.

Fortinet's advisory and the severity​

Fortinet tracks the bug as PSIRT advisory FG-IR-26-175. FortiGuard's advisory listing shows FG-IR-26-175 Improper limitation of a pathname to a restricted directory CVE-2026-104286, published October 1, 2026, and classed as unauthenticated and Critical. Aggregators using the CVE record list a CVSS v3.1 base score of 9.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That means it is reachable over the network, easy to exploit, needs no privileges or user action, and has high impact on confidentiality, integrity and availability.

The CVE record describes the issue as affecting Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9.

Watch for the version-list conflict​

The published data doesn't fully agree with itself. The structured affected-software table that Strix pulled from the CNA advisory lists 8.0.0; >= 7.6.0, <= 7.6.5; >= 7.4.0, <= 7.4.6; >= 7.2.0, <= 7.2.9; >= 7.0.0, <= 7.0.9. That table puts the 7.0 branch in scope even though the prose description leaves it out, and it ends the 7.6 and 7.4 ranges earlier than the description does. Strix also notes that NVD analysis pending.

What does that mean for admins? Use the broader reading until Fortinet clarifies:

If you run any version in either column, assume you are exposed until FG-IR-26-175 tells you otherwise.

Section summary: The bug is critical at CVSS 9.8, needs no authentication, and is reachable over the network. The affected-version data is inconsistent, so read it broadly.

Where the bug is and what attackers leave behind​

According to an operator write-up by HOL Guard, which cites Fortinet's advisory and the KEV catalog, the vulnerable path is the GUI component that backs Identity Based Encryption (IBE). With IBE reachable, a stranger who can hit the HTTP/HTTPS listener can plant files on the box. HOL Guard also reports that Fortinet rated the flaw Critical, marked it as known exploited, and publishes Indicators of Compromise from active campaigns.

HOL Guard's summary of those indicators is the list incident responders should work from: Fortinet's advisory lists dropped and modified binaries under /data and /bin, a malicious ld.so.preload, altered httpd.conf, and C2 IPs. A tampered ld.so.preload is a well-known Linux persistence trick. It loads attacker code into every dynamically linked process, so it is the kind of implant that can outlast a firmware update if no one goes looking for it. That is general industry knowledge, not a claim from the advisory, but it explains why CISA wants forensic triage alongside the patch.

Fixes and workarounds: available, or still coming?​

Here the reports disagree, so be careful.

• HOL Guard's guidance says to disable FortiMail IBE (config system encryption ibe / set status disable) or upgrade to upcoming 8.0.2 / 7.6.7 / 7.4.9. By that account, the fixed builds were still on the way when it was written.
• The CVE metadata collected by OffSeq's Threat Radar shows Remediation Level: official-fix, which suggests a fix exists for at least some branches.
• No source I could find names a fix for the 7.2 branch, or for 7.0 if it is affected.

HOL Guard's fix list also points to the conflict from the other side. A fix in 7.6.7 fits the prose range ending at 7.6.6, but a fix in 7.4.9 doesn't fit a table that ends at 7.4.6. Use Fortinet's advisory as the authority on which build actually closes the hole for your branch. Treat the CLI workaround above as reported by a third party, and check it against the advisory before running it in production.

What to do now​

For FortiMail administrators, in order:

1. Inventory. Find every FortiMail appliance and VM, including lab units, DR standbys and the HA secondary someone forgot about. Record exact firmware versions.
2. Check exposure. Find out whether the web GUI or IBE web portal is reachable from the internet. BOD 26-04 counts a resource as publicly exposed if it is accessible to unauthenticated or untrusted entities via public networks, wherever it physically sits. That's a sensible test for anyone.
3. Mitigate now. If a fixed build isn't available for your branch, disable IBE if you can live without it, or at least restrict access to the HTTP/HTTPS interfaces, following Fortinet's advisory. Disabling IBE turns off identity-based email encryption, so warn whoever relies on it before you do it.
4. Hunt before you patch, and after. Check for the indicators Fortinet reportedly published: unexpected files under /data and /bin, an ld.so.preload that shouldn't exist, httpd.conf changes, and traffic to the listed C2 addresses. Keep logs and a snapshot first. An upgrade can wipe evidence without guaranteeing the implant is gone.
5. Upgrade. Move to the fixed release for your branch once Fortinet confirms it, then hunt again.
6. If you find signs of compromise, follow your incident-response process. Assume that mail flow, credentials and anything the appliance could reach may be exposed.

Who is bound by the deadline?​

Only Federal Civilian Executive Branch agencies are legally bound by BOD 26-04. CISA also states that every organization, including state, local, tribal and territorial governments and private industry, can strengthen its security by prioritizing KEV vulnerabilities, even though the directive doesn't bind them. Private companies don't legally owe CISA anything by October 4, but attackers are already using this bug either way.

Section summary: Inventory, restrict access, hunt for indicators, then patch. Check whether a fixed build exists for your branch with Fortinet rather than trusting secondary reports.

Why this matters​

This isn't the first unauthenticated critical bug to hit FortiMail. In 2025, CVE-2025-32756, a stack-based buffer overflow, affected FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0 through 7.4.4, FortiMail 7.2.0 through 7.2.7, FortiMail 7.0.0 through 7.0.8 along with several other Fortinet products. NVD said it let a remote unauthenticated attacker execute arbitrary code through crafted HTTP requests.

Email gateways are attractive targets. They face the internet by design, they handle sensitive data by definition, and many organizations trust them by default. Windows-heavy shops running Exchange or Microsoft 365 often put a FortiMail in front of their mail, which makes it the first thing an attacker meets.

There's a fair counterpoint. KEV inclusion means exploitation has happened somewhere. It doesn't mean your appliance is compromised, and CISA itself treats the catalog as one input to prioritization rather than a verdict. But with no authentication required, a CVSS of 9.8, published IoCs and a three-day federal deadline, it's hard to argue this can wait for the next maintenance window. A FortiMail unit facing the internet, running an affected build with IBE on, should be treated as urgent today.

Bottom line​

• What happened: CISA added CVE-2026-104286, a FortiMail path traversal and NULL-byte flaw that allows unauthenticated arbitrary file write, to the KEV catalog on October 1, 2026, because it is being actively exploited.
• Federal deadline: October 4, 2026, with forensic triage required under BOD 26-04.
• Affected: FortiMail 8.0, 7.6, 7.4 and 7.2. Some advisory data also includes 7.0, and the version ranges conflict.
• Reported workaround: Disable IBE or restrict GUI access. Reported fixed builds are 8.0.2, 7.6.7 and 7.4.9, but their availability isn't clear.
• The step people skip: Hunt for compromise. Updating the firmware doesn't prove the box is clean.