Fortinet has warned that attackers are exploiting a critical vulnerability in its FortiMail email security gateway for which no patch is yet available, BleepingComputer reported Thursday. The flaw, tracked as CVE-2026-104286 with a CVSS score of 9.8, can let an unauthenticated attacker take over an appliance, and the U.S. Cybersecurity and Infrastructure Security Agency has ordered federal agencies to deal with it within three days.

What Happened

According to Fortinet's advisory, the bug combines a path traversal weakness with improper handling of null bytes in FortiMail's management interface. By sending crafted HTTP or HTTPS requests, an attacker without credentials can write arbitrary files to the underlying system, which can lead to code or command execution.

Affected releases are FortiMail 7.2.0 through 7.2.9, 7.4.0 through 7.4.8, 7.6.0 through 7.6.6 and 8.0.0 through 8.0.1. Fortinet lists fixes in versions 7.4.9, 7.6.7 and 8.0.2 but has not released them or given a date. Help Net Security reported that the 7.2 branch will not be patched and that customers on it need to move to 7.4 or later.

RelatedSuspected Chinese Spies Exploited BeyondTrust Remote Support Flaw Since August, Google Says

The flaw was found internally by Gwendal Guégniaud of Fortinet's product security team. Fortinet says it has been exploited in the wild but has not disclosed a timeline, victim count or attacker.

Why It Matters

FortiMail sits in the email path for the organizations that run it and is usually reachable from the internet, which makes an unauthenticated file-write bug especially dangerous. An attacker with control of a mail gateway may be able to read, alter or redirect message traffic and use the device as a foothold inside the network.

With no fixed build to install, administrators have to rely on workarounds. Fortinet recommends disabling support for identity-based encryption (IBE), the feature FortiMail uses to send encrypted mail to recipients based on their identity, through the command line. It also advises restricting the management interface to trusted internal networks and blocking internet access to it.

CISA added the vulnerability to its Known Exploited Vulnerabilities catalog Thursday. SecurityWeek reported that, under Binding Operational Directive 26-04, federal civilian agencies have three days to address it, making the deadline Oct. 4. Help Net Security said agencies are expected to carry out forensic triage as well as mitigation.

Signs of Compromise

Fortinet published indicators of compromise to help defenders check whether they have already been hit. BleepingComputer reported that they include SHA-256 hashes for modified or added files, among them a library named liblog.so, a binary named smit, webconsole and mailservice components, the httpd.conf web server configuration, ld.so.preload and an archive named migadmin.tar.gz. The list also includes two attacker IP addresses.

Changes to ld.so.preload are a known persistence technique on Linux-based systems, because the file can force a malicious library to load into every process. Because the attackers wrote files to disk, organizations that apply only the workarounds should still check for these artifacts.

Fortinet products are frequent targets for both criminal and state-backed hackers, and dozens of the company's vulnerabilities appear in CISA's exploited catalog.

What to Watch

The key date is the release of FortiMail 7.4.9, 7.6.7 and 8.0.2, which Fortinet has not scheduled. Organizations on the 7.2 branch face a version upgrade rather than a patch. Watch for Fortinet or researchers to attribute the attacks and say how many appliances were compromised, and for updates to the indicator list as more incident data comes in.