Unauthenticated File Writes Through a Mail Gateway's Back Door — FortiMail Zero-Day CVE-2026-104286 and the IBE Interface
Fortinet disclosed on October 1 a path-traversal zero-day in FortiMail (CVE-2026-104286, CVSS 9.8) that allows unauthenticated arbitrary file writes, with in-the-wild exploitation confirmed. CISA added it to the KEV catalog the same day with a federal deadline of October 4. No patched release exists on any of the four affected branches, so the IBE-disable workaround is the stopgap — we examine it against the late-September KEV surge.
The article body is not available in this language; showing English.
On October 1, 2026, Fortinet disclosed CVE-2026-104286 in FortiMail via PSIRT advisory FG-IR-26-175. The flaw combines an improper limitation of a pathname to a restricted directory (path traversal, CWE-22) with improper neutralization of NULL bytes (CWE-158): an unauthenticated attacker can write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. The NVD CVSS v3.1 score is 9.8 (CRITICAL, reported by Fortinet PSIRT as the CNA). Four release branches are affected: FortiMail 8.0.0-8.0.1 (upgrade to the upcoming 8.0.2 or above), 7.6.0-7.6.6 (upcoming 7.6.7 or above), 7.4.0-7.4.8 (upcoming 7.4.9 or above), and 7.2.0-7.2.9 (upgrade to branch 7.4 or above). As of October 2, the fixes for the three newer branches are still marked 'upcoming', and the 7.2 branch has no fixed release planned. Fortinet states the bug 'has been reported to be exploited in the wild' and urges customers to apply the workaround: disable the IBE (Internet Based Encryption) feature via the GUI (Encryption -> IBE -> IBE Service 'off') or the CLI (config system encryption ibe / set status disable); alternatively, disable internet access to the FortiMail webmail interface or restrict it to trusted private networks, or, with a WAF in front, block POST requests to /ibe containing '../'. Fortinet also published two source IPs plus system-event and encryption-log examples as indicators of compromise, and credited the discovery to Gwendal Guégniaud of the Fortinet Product Security team (FG-IR-26-175).
CISA added the vulnerability to its KEV catalog on October 1, giving federal civilian agencies until October 4 — today — to respond (BOD 26-04, three days from listing). The KEV notes require applying vendor-directed mitigations in line with BOD 26-04 and CISA's Forensics Triage Requirements, and forensic triage is flagged Yes. Fortinet's IoC includes encryption-log entries from IBE decryption failures, which suggests the exploitation path runs through the IBE interface; Fortinet has not formally described the attack vector, so treat that as inference, not fact (inference is separated from reporting below). The recent KEV additions show 17 entries between September 20 and October 2: Zyxel GS1900 (CVE-2026-7273), Arista VeloCloud Orchestrator (CVE-2026-93952), F5 BIG-IP APM (CVE-2026-94127), two Check Point management-server flaws (CVE-2026-93616 / CVE-2026-85102), WSO2 (CVE-2026-5430), Adobe Commerce and Magento (CVE-2026-71362), MikroTik RouterOS (CVE-2026-67279), Microsoft SharePoint (CVE-2026-65660), WordPress Core (CVE-2026-87902), two Citrix NetScaler flaws (CVE-2026-88772 / CVE-2026-88771), Cisco Catalyst SD-WAN Manager (CVE-2026-76504), Apple (CVE-2026-86950), this FortiMail flaw (CVE-2026-104286), and two Zammad flaws (CVE-2026-102490 / CVE-2026-102489) — many of them management or feature interfaces on boundary appliances (CISA KEV catalog, 2026.10.02).
Analysis (separated from facts): what deserves attention is that unauthenticated access to a non-authenticated interface lands directly in a root-level file write. The Cisco SEG zero-day this observatory covered on September 15 (CVE-2026-76461) is nearly the same shape: unauthenticated request handling in a mail gateway reaching root execution through SQL injection, with in-the-wild exploitation confirmed and a KEV listing to follow. Two zero-days on appliances that share the mail-gateway role entered KEV within three weeks, and the target in both is a feature interface on the gateway rather than the mail path itself. IBE is an email-encryption feature that many deployments may have enabled only for a narrow set of senders; where it is enabled, its interface can stay reachable from the internet as a side effect. A single feature leaves an unauthenticated entry point — that is the structural point. Fortinet's note that the defect was found internally is the same pattern as the F5 BIG-IP APM flaw (CVE-2026-94127) and can suggest a quiet exploitation window before disclosure. The absence of any fixed release for the 7.2 branch means those sites cannot simply 'patch' before the October 4 deadline; the decision is to move branches or shut the feature down.
Defensive implications: (1) Where IBE is not in use, disabling it via the GUI or CLI is the first priority; it is exactly the 'mitigation in accordance with vendor instructions' CISA's KEV notes point to. (2) Where IBE is in use, block POSTs to /ibe containing '../' at a WAF, or restrict webmail access to trusted private networks; both are stopgaps to pair with the final release. (3) Run detection against Fortinet's IoC (the cron-launched /bin/sh -c and archive-account additions in system logs, the IBE decryption exception in encryption logs) while reviewing firewall / NetFlow history for traffic to /ibe, on the premise that the appliance's own logs may no longer be a primary source. (4) For 7.2-branch sites, start the migration plan to 7.4 or later now; with no fixed release, the deadline measures up to migration or isolation. (5) In the boundary-appliance inventory, re-check the public exposure of single-feature interfaces like IBE. The two Citrix NetScaler entries (listed September 27) and the Cisco Catalyst SD-WAN Manager entry (listed September 30) are part of the same run of KEV additions, with the same three-day windows closing. Facts here draw on Fortinet's advisory FG-IR-26-175 (https://fortiguard.fortinet.com/psirt/FG-IR-26-175), the CISA KEV catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog), and the NVD CVE record (https://nvd.nist.gov/vuln/detail/CVE-2026-104286). Analysis is kept separate from reporting.