Fortinet warned on October 1 that attackers are exploiting FortiMail vulnerability CVE-2026-104286, a critical flaw in the email security appliance that can let an unauthenticated remote attacker write files to its underlying system. The company rated the issue 9.8 on the CVSS scale and published temporary mitigations while fixes for several supported branches remain pending.

FortiMail filters email and is often deployed at a network boundary. According to Fortinet’s advisory, its Product Security team discovered the flaw internally. Affected releases are FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9. Fortinet has not publicly identified the attackers or disclosed how many systems were compromised.

Fortinet describes the issue as path traversal combined with improper handling of null bytes. Crafted HTTP or HTTPS requests to the web management interface can cause a file to be written outside the intended directory without a login. Security firm watchTowr says the ability to place files on the appliance creates a route to command execution. Internet-exposed management interfaces are the immediate concern.

Fortinet’s published indicators of compromise include an added /data/lib/liblog.so file, an added /data/etc/ld.so.preload file, and two IP addresses associated with the observed attacks: 79.141.169.187 and 45.129.0.192, according to BleepingComputer’s account of the advisory. The advisory also lists file hashes and log events for incident review. A matching indicator warrants investigation; it does not alone establish the full scope of an intrusion.

For affected systems, Fortinet recommends disabling Identity-Based Encryption or removing internet access to the management interface and allowing only trusted private networks. BleepingComputer reports that FortiMail 7.2 users can move to the 7.4 branch or later, while fixes for affected 7.4, 7.6, and 8.0 deployments were still upcoming at disclosure. Administrators should check the current Fortinet advisory before choosing an upgrade path.

CISA added CVE-2026-104286 to its Known Exploited Vulnerabilities catalog on October 1 and set an October 4 deadline for federal agencies to conduct forensic triage and mitigate the flaw, as reported by watchTowr. Organizations operating FortiMail should inventory versions, restrict exposed management access, review Fortinet’s indicators, and install a fixed release when it becomes available.