FortiMail Zero-Day CVE-2026-104286: Exploited, Not Yet Patched, and Full of Mail

Most urgent vulnerability stories end with “patch now.” This one cannot, because the patch does not exist yet. Fortinet advisory FG-IR-26-175, published on 1 October, describes CVE-2026-104286, a critical flaw in FortiMail that lets an unauthenticated attacker write arbitrary files to the appliance through crafted HTTP or HTTPS requests. Fortinet says it has been exploited in zero-day attacks. CISA added it to the Known Exploited Vulnerabilities catalog the same day, with a federal deadline of 4 October.

FortiMail sits in the path of an organisation's email. That makes the interim question less about the bug and more about what you are sending through the box while you wait.

What is confirmed

Fortinet describes the issue as path traversal and null-byte neutralisation flaws, rated 9.8 on CVSS. The affected releases are FortiMail 7.2.0 through 7.2.9, 7.4.0 through 7.4.8, 7.6.0 through 7.6.6 and 8.0.0 through 8.0.1. Fixes are planned in 7.4.9, 7.6.7 and 8.0.2, none of which had been released when the reporting we reviewed was published, and Fortinet has not given dates. Customers on 7.2 are advised to move to the 7.4 branch or later. BleepingComputer and Help Net Security report the same versions, fixes and workarounds, Cybersecurity Dive confirms the exploitation and the workarounds, and Help Net Security credits the discovery to Fortinet's own product security team.

Two interim measures are published. You can disable support for IBE, FortiMail's identity-based encryption feature, using the command line, or you can block internet access to the management interface and restrict it to a trusted private network. Fortinet also published indicators of compromise: a small set of malicious file hashes, two attacker IP addresses and log entries. We deliberately do not reproduce them here. Take them from the advisory so you are working from the maintained list.

What is not known

When exploitation began and how widely. Help Net Security lists the timing, location and victim count as unknown, and none of the reporting names an actor.
What attackers did next. The documented impact is arbitrary file write. Reporting does not describe web shells, stolen credentials or mail access in confirmed cases. Cybersecurity Dive says the flaw can enable access to stored email and credentials, which is a reasonable inference from file-write on a mail appliance and not a published finding. We treat it as a risk to plan for, not a fact.
When the patches arrive. Fortinet has not said.
Whether disabling IBE is safe for you. The reporting gives the setting but not the side effects. Check how your organisation uses IBE before switching it off.

Why a mail gateway is a secrets problem

A mail security appliance sees messages in transit and typically keeps copies in quarantine, logs and sometimes archives. It also holds its own credentials: directory bind accounts, relay credentials, administrator accounts, TLS certificates and keys, and, where it signs outbound mail, signing keys. A file-write primitive is not the same as reading any of that, but arbitrary file write on an appliance is the kind of foothold that tends to lead further, which is why the vendor and CISA treat it as urgent.

The less visible exposure is behaviour. Most organisations have, at some point, emailed a temporary password, a reset link, a wifi key or an API token. Those messages do not vanish after they are read: they pass through the gateway and may sit in quarantine or archive storage. The longer the habit has run, the more of it is stored somewhere an attacker with a foothold could look.

What to do before the patch exists

Find every FortiMail you run, including virtual appliances and ones managed by a provider, and note the version and whether IBE is in use.
Cut off the management interface now. If it faces the internet, restrict it to a private network. This is Fortinet's own interim measure and costs little.
Decide about IBE. If you do not rely on it, disable it per the advisory. If you do, work out what breaks for your recipients first and weigh that against the exposure.
Check for compromise using the advisory's indicators. Search for the listed files and addresses and review the logs Fortinet points to. Preserve what you find before changing anything.
Watch for the fixed builds and apply them promptly. The CISA deadline suggests how urgent the government considers this, even though a fix is not yet available.
If you find indicators, treat the appliance as compromised. Rebuild it rather than clean it, and rotate what it held: administrator and directory bind credentials, relay credentials, any API tokens, TLS certificates and keys, and mail-signing keys, with the matching DNS changes.
Stop adding to the pile. Until you trust the gateway again, do not email passwords, recovery codes or tokens. Use another channel for them.
Inventory what has already been emailed. Search the archive and quarantine you control for credentials that are still live, prioritise long-lived ones, and rotate them.

Where Secretus fits, and where it does not

Secretus covers step 7. A short secret is encrypted in the sender's browser and shared as a link that stops working after the expiry you set or the first successful open. The email carries a link, not the value, so the mail path no longer stores the secret itself. Team Split can require several holders to reconstruct a high-value text secret. Be aware that the link still travels by whatever channel you send it, so for sensitive values send the link and the context over separate channels.

It is not an email security product, a patching tool or a secrets manager. It cannot harden FortiMail, check an appliance for compromise, rotate a directory password or clean credentials out of mail already stored. Do those with Fortinet's guidance and your own tooling, and use a one-time link so the next password does not end up in a mailbox that an attacker may have reached.