Fortinet Warns of Exploited FortiMail Path Traversal
Tech GuruQuick Answer
Fortinet's October 5 revision now lists fixed FortiMail releases for exploited CVE-2026-104286. Preserve evidence, keep management access restricted, install the supported branch fix, validate IBE and mail flow, and retain the result.
Preserve Evidence And Apply The Available FortiMail Fix
What to do now: Identify affected FortiMail appliances, preserve Fortinet-listed indicators and relevant logs, maintain containment, install the supported fixed release for each branch, and validate mail and IBE operations.
Last verified: 2026-10-06 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | FortiMail 8.0, 7.6, 7.4, and 7.2 release families in the advisory-listed ranges |
|---|---|
| Advisory | FG-IR-26-175 |
| CVE | CVE-2026-104286 |
| Authoritative release date | 2026-10-01 00:00:00 UTC |
| Authority revision date | 2026-10-05 00:00:00 UTC |
| Affected versions | FortiMail 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8, and 7.2.0–7.2.9. |
| Fixed version | FortiMail 8.0.2, 7.6.7, or 7.4.9; migrate 7.2 deployments to 7.4 or later |
| CVSS base score | 9.8 (official CVSS v3.1) |
| CVSS severity | Critical |
| Exploitation status | Fortinet confirms exploitation in the wild; CISA added the CVE to KEV on 2026-10-01; no exploitation claim is inferred. |
What Changed
Fortinet revised FG-IR-26-175 on October 5 to identify available fixed releases for the exploited unauthenticated FortiMail path-traversal and NULL-byte issue.
What To Validate Now
- Inventory. Record every FortiMail appliance, exact firmware, management and webmail exposure, IBE usage, mail-flow dependencies, accountable owner, and current containment state.
- Establish applicability. Compare each deployment with Fortinet's affected ranges: 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8, and 7.2.0–7.2.9. Do not infer applicability from product family or severity alone.
- Remediate. Upgrade FortiMail 8.0 to 8.0.2 or later, 7.6 to 7.6.7 or later, and 7.4 to 7.4.9 or later; migrate 7.2 to 7.4 or later. Until updating, disable IBE or limit webmail access to trusted private networks, or use the advisory-listed WAF control.
- Validate. Confirm the running firmware and management-plane restrictions, verify IBE and mail flow, inspect Fortinet's current indicators and logs, monitor for recurrence, and document the result.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
A clean indicator review does not prove absence of compromise. Preserve appliance and volatile evidence before cleanup, coordinate IBE and firmware changes with mail operations, and follow the supported branch upgrade path and rollback procedure.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
