Fortinet warns of critical FortiMail zero-day exploited in attacks

According to a BleepingComputer report dated 1 October 2026, Fortinet has disclosed that a critical flaw in its FortiMail email security product, tracked as CVE-2026-104286, is being exploited in zero-day attacks. Advisory FG-IR-26-175 rates it CVSS 9.8. The bug is in the management interface: by sending specially built HTTP or HTTPS requests, an attacker who has not logged in can place files of their choice on the appliance's operating system.

• Affected versions: FortiMail 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8 and 7.2.0–7.2.9.
• No security update exists yet for 7.4, 7.6 and 8.0; Fortinet lists 7.4.9, 7.6.7 and 8.0.2 as the upcoming fixed releases. Users on 7.2 are advised to move to 7.4 or later.
• As a temporary measure, Fortinet advises disabling the IBE feature, or blocking Internet access to the management interface and limiting it to trusted internal networks.
• CISA added the flaw to its exploited vulnerabilities catalog and ordered US federal agencies to carry out forensic triage and mitigate it by 4 October.

Why it matters

FortiMail is used to secure company email, so a compromised appliance could put correspondence and account details at risk. Fortinet has not said when the attacks began, how many devices were hit or who is behind them. IT teams in Türkiye that run FortiMail should check whether the management interface is reachable from the Internet and apply the workaround until patches arrive.

Indicators of compromise listed in the report include unexpected files such as /data/lib/liblog.so, modified system and configuration files and an archive account named archive234 added from the command line. That account may point to data being sent to a remote server, so device logs should be reviewed as well.