Fortinet FortiMail CVE-2026-104286: unauthenticated file write through the IBE endpoint, exploited as a zero-day

What happened

On 1 October 2026, Fortinet published FG-IR-26-175 for CVE-2026-104286, rated CVSS 9.8. A path traversal combined with a NULL-byte handling flaw lets an unauthenticated attacker write arbitrary files on the FortiMail system with crafted HTTP or HTTPS requests. Fortinet lists the impact as execution of unauthorized code or commands, and marks it “Known Exploited: Yes” (Fortinet). Fortinet’s own Product Security team found it. Fortinet’s workaround and WAF rule both point at IBE (Identity Based Encryption), the encryption feature served at /ibe.

CISA added it to KEV on 1 October, with a due date of 4 October (CISA KEV). Fortinet published no attribution or victim numbers.

The indicators Fortinet published show what an intrusion looked like (Fortinet):

• A root cron job running /bin/sh -c 'O=/migadmin ...'.
• The admin user adding a remote archive account named archive234 from the CLI. It sends archived mail every hour to 79.141.169.187, in the remote directory /uploads. That is a way to copy the organisation’s email off the appliance.
• IBE decrypter errors reporting Invalid Base64 Encoding at pos 0. Character=0x2a, followed by a failed login for an internal user *@<your domain>.

Fortinet updated the advisory on 5 and 7 October. FortiMail Cloud was fixed on 5 October by moving all instances to 7.6.7 or 8.0.2, and cloud customers need do nothing.

Am I affected?

Source: Fortinet. As of 2 November 2026, Fortinet’s documentation site still lists 7.2.9 as the newest 7.2 release (Fortinet docs).

Check the running version from the FortiMail CLI:

get system status

Then check whether IBE is enabled (GUI: Encryption, then IBE, then IBE Service) and whether webmail and /ibe are reachable from the internet.

Look for the published indicators. In the FortiMail logs, search for the following. Also review every archive account in the configuration and confirm each one is yours.

• Event logs with ui=cron running /bin/sh -c 'O=/migadmin.
• Config logs containing Added 'archive234' to 'archive account', or any archive account with destination[remote] that you did not set up.
• Encryption logs containing Invalid Base64 Encoding at pos 0. Character=0x2a.
• Traffic to or from 79.141.169.187 or 45.129.0.192.

What to do now

1. Upgrade to 8.0.2, 7.6.7 or 7.4.9 or later (Fortinet).
2. On 7.0 and 7.2, or until you can upgrade, disable IBE. In the GUI, set Encryption, IBE, IBE Service to off. In the CLI:

config system encryption ibe
    set status disable
end

3. If you need IBE running, Fortinet’s alternatives are to block internet access to the webmail interface, or limit it to trusted private networks, or, with a WAF in front, block POST requests to /ibe that contain ../ (Fortinet).
4. Remove any archive account you did not create and check where it was sending mail. An account like archive234 means mail was being copied out. Treat that as an email data breach for the period it existed.
5. If you find any indicator, treat the appliance as compromised. The attacker had root cron and admin CLI access. Rebuild from a clean firmware image and a reviewed configuration rather than deleting the cron entry. Review admin accounts, and change the credentials of accounts the logs show were used.

Sources

• Fortinet PSIRT: FG-IR-26-175
• CVE-2026-104286 record
• CISA Known Exploited Vulnerabilities catalog
• Fortinet documentation: FortiMail 7.2 releases