Unauthenticated file writing through di mail gateway back door — FortiMail zero-day CVE-2026-104286 and di IBE feature
For 1 October, Fortinet disclose di path traversal zero-day wey dey inside FortiMail (CVE-2026-104286, CVSS 9.8) wey make unauthenticated arbitrary file writing possible, and confirm say di exploitation don happen in di wild. CISA add am to KEV catalog same day with di federal deadline for 4 October. No patched release don publish for any of di four affected branches, so disabling IBE be di stopgap — we dey look am against di late-September KEV surge.
Dis article na machine translation.
For 1 October 2026, Fortinet disclose CVE-2026-104286 inside FortiMail through PSIRT advisory FG-IR-26-175. Di flaw combine no-proper limiting of di pathname to di restricted directory (path traversal, CWE-22) with no-proper neutralization of NULL bytes (CWE-158): an unauthenticated attacker fit write arbitrary files on di underlying system through crafted HTTP or HTTPS requests. Di CVSS v3.1 score from NVD be 9.8 (CRITICAL, report by Fortinet PSIRT as di CNA). Four release branches don affect: FortiMail 8.0.0–8.0.1 (upgrade to di upcoming 8.0.2 or above), 7.6.0–7.6.6 (upcoming 7.6.7 or above), 7.4.0–7.4.8 (upcoming 7.4.9 or above), and 7.2.0–7.2.9 (upgrade to branch 7.4 or above). As of 2 October, di fixes for di three newer branches still dey mark as 'upcoming', and no fixed release don plan for di 7.2 branch at all. Fortinet say di bug 'don report as exploited in di wild', and dem urge customers to apply di workaround: disable di IBE (Internet Based Encryption) feature through GUI (Encryption -> IBE -> IBE Service 'off') or CLI (config system encryption ibe / set status disable); or disable access from di internet to di FortiMail webmail interface or restrict am to trusted private networks; or, where di WAF dey front, block POST requests to /ibe wey contain '../'. Fortinet publish two source IPs and examples from di system and encryption logs as IoC too, and note say Gwendal Guégniaud of di Fortinet Product Security team discover di defect internally (FG-IR-26-175).
CISA add di vulnerability to im KEV catalog for 1 October and give di federal civilian agencies until 4 October — today — to respond (BOD 26-04, three days from listing). Di KEV notes direct operators to apply di mitigation wey di vendor instruct, in line with BOD 26-04 and CISA Forensics Triage Requirements; forensicTriage dey mark as Yes. Di Fortinet IoC include entries from di encryption log wey come from IBE decryption failures, wey suggest say di exploitation path go through di IBE interface; Fortinet no officially describe di attack vector, so treat am as inference, not fact (di inference dey separated from di facts below). Di recent KEV additions show 17 entries between 20 September and 2 October: Zyxel GS1900 (CVE-2026-7273), Arista VeloCloud Orchestrator (CVE-2026-93952), F5 BIG-IP APM (CVE-2026-94127), two Check Point management-server flaws (CVE-2026-93616 / CVE-2026-85102), WSO2 (CVE-2026-5430), Adobe Commerce and Magento (CVE-2026-71362), MikroTik RouterOS (CVE-2026-67279), Microsoft SharePoint (CVE-2026-65660), WordPress Core (CVE-2026-87902), two Citrix NetScaler flaws (CVE-2026-88772 / CVE-2026-88771), Cisco Catalyst SD-WAN Manager (CVE-2026-76504), Apple (CVE-2026-86950), di FortiMail flaw dis one (CVE-2026-104286), and two Zammad flaws (CVE-2026-102490 / CVE-2026-102489) — many of dem be management or feature interfaces on boundary appliances (CISA KEV catalog, 2026.10.02).
Analysis (separated from di facts): wetin deserve attention na say unauthenticated access to di interface wey no demand authentication land directly on di root-level file write. Di Cisco SEG zero-day wey dis observatory cover for 15 September (CVE-2026-76461) na almost di same shape: unauthenticated request handling inside di mail gateway reach root execution through SQL injection, and in-the-wild exploitation confirm too before di KEV listing. Two zero-days on appliances wey share di mail-gateway role enter KEV inside three weeks, and in both cases di target be di feature interface on di gateway, not di mail path itself. IBE na di mail-encryption feature wey many deployments go enable for a narrow sender group only; where e dey on, di interface fit remain reachable from di internet as di side effect. One feature leave behind di unauthenticated entry point — dat be di structural point. Di Fortinet note say di defect discover internally follow di same pattern as di F5 BIG-IP APM flaw (CVE-2026-94127), and e fit suggest di quiet exploitation window before disclosure. Say di 7.2 branch no got any fixed release mean say di sites no fit simply 'patch' before di 4 October deadline: di decision na move branch or shut di feature.
Defensive meaning: (1) Where IBE no dey use, disabling am through GUI or CLI na di top priority; e be exactly di 'mitigation per vendor instructions' wey di CISA KEV notes point to. (2) Where IBE dey use, block POSTs to /ibe wey contain '../' at di WAF, or restrict webmail access to trusted private networks; both be stopgaps wey go pair with di final release. (3) Run detection against di Fortinet IoC (di cron-launched /bin/sh -c and di archive-account addition in di system logs, di IBE decryption exception in di encryption log), and on di premise say di appliance own logs fit no be di primary source again, review di firewall / NetFlow history for di traffic to /ibe. (4) For di 7.2-branch sites, start di migration plan to 7.4 or above now; without di fixed release, di deadline answer na migration or isolation. (5) In di boundary-appliance inventory, re-check di public exposure of di single-feature interfaces like IBE. Di two Citrix NetScaler entries (list for 27 September) and di Cisco Catalyst SD-WAN Manager entry (list for 30 September) part of di same run of di KEV additions, with di same three-day window. Di facts here draw on di Fortinet advisory FG-IR-26-175 (https://fortiguard.fortinet.com/psirt/FG-IR-26-175), di CISA KEV catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog), and di NVD CVE record (https://nvd.nist.gov/vuln/detail/CVE-2026-104286). Di analysis dey kept separate from di reporting.