The FortiMail Zero-Day Finally Has a Fix. Fortinet’s Own Logs Show Attackers Pointed the Mail Archive at Their Server, and Patching Won’t Undo It.

Fortinet has finally attached fixed builds to its FortiMail zero-day advisory. The same advisory now shows how intruders behaved once inside: they created a mail-archive account that sends data to an attacker-controlled server. Upgrading closes the hole. It does not remove an archive account someone else set up.

DataWater Threat Intelligence Desk | Published October 7, 2026 | 7-minute read

Threat level: Critical (exploited)

What: CVE-2026-104286, an unauthenticated arbitrary file write in the Identity-Based Encryption (IBE) component of Fortinet FortiMail, CVSS 9.8. Advisory FG-IR-26-175.

Status: Exploited in the wild. On CISA’s Known Exploited Vulnerabilities catalog since October 1, 2026. Fortinet logged a “solution update” to the advisory on October 5.

Deadline: CISA’s federal deadline was Sunday, October 4, 2026. Any agency or enterprise still unpatched is past it.

Fix: Upgrade to FortiMail 8.0.2, 7.6.7 or 7.4.9 or later. FortiMail 7.2 has no fix of its own: move to a fixed 7.4+ build. Then check for the rogue archive account.

Executive Summary

The FortiMail zero-day now has a fix. Whether you also need an incident response is a separate question.

When DataWater first covered the FortiMail zero-day CVE-2026-104286 on October 3, Fortinet’s advisory described the fixed releases as upcoming and the only defense was a workaround: turn off IBE and keep the web interface off the internet. On October 5, Fortinet recorded a “solution update” to FG-IR-26-175. The solutions table now tells customers to upgrade to 8.0.2, 7.6.7 or 7.4.9 or later, and 7.2 customers to move to the 7.4 branch or above.

The advisory also carries more detail on attacker behavior than our first briefing covered. Beyond the planted files and two attacker IPs, Fortinet lists event-log entries showing a new remote archive account aimed at an attacker address, a root-level scheduled command involving the /migadmin path, and IBE encryption errors. Read together, they suggest exploitation went past a foothold to taking data out through a built-in feature.

The bottom line: upgrade every FortiMail appliance now. Before you do, check each one for the archive account, the cron entry and the file indicators. If any are there, you have an incident, not a patching task.

Why This Matters to CISOs and Security Leaders

The exfiltration path is a legitimate feature. Mail archiving to a remote server is a normal, configured function on FortiMail. An attacker who adds an archive destination does not need custom malware to collect mail. The traffic looks like the appliance doing its job, which is why it can survive a patch and a casual review.

The deadline passed before the fix existed. CISA’s patch-or-mitigate date was October 4. Fixed builds were not confirmed until at least the following day. Organizations that relied on the workaround should now finish the job, and should be ready to explain to auditors what they did between October 1 and the upgrade.

Edge-device fatigue is real. The same teams are handling the NetScaler SAML zero-day CVE-2026-88779, whose CISA deadline is today, and the Cisco SD-WAN Manager flaw CVE-2026-76504. A mail gateway that was “mitigated” last week is easy to deprioritize. Don’t.

The Timeline

The attackers didn’t need to smuggle mail out. They configured FortiMail to send it for them.

Vulnerability & Exploit Analysis

What CVE-2026-104286 is

CVE-2026-104286 is a path traversal weakness (CWE-22) combined with improper handling of NULL bytes (CWE-158) in FortiMail’s Identity-Based Encryption service. A crafted HTTP or HTTPS request to the /ibe endpoint lets an unauthenticated attacker write files outside the intended directory. Fortinet rates it CVSS v3.1 9.8 and says the file writes can lead to unauthorized code or command execution. One analysis notes IBE is disabled by default, which narrows exposure to appliances where it was switched on (single-source).

Affected and fixed versions

Interim protections

If you cannot upgrade today, Fortinet’s workarounds still apply: disable IBE (Encryption > IBE, set the IBE service to off), limit the webmail interface to trusted networks, or, if a web application firewall sits in front of FortiMail, block POST requests to /ibe that contain ../. The WAF rule is a useful extra layer for organizations that depend on IBE and cannot turn it off.

Threat Intelligence Breakdown

Attribution: Unknown. Fortinet has not named an actor, and one analysis states there was no public attribution as of October 5. Victim count is also unknown.

What the indicators show: attackers wrote their own components to the appliance, used a preload file so they load automatically, changed the web server configuration, scheduled a root command involving /migadmin, and then created an archive account that sends to an attacker IP. One analysis interprets the cron job as dumping the appliance configuration and deleting it after about a day (single-source).

Indicators of compromise (Fortinet advisory FG-IR-26-175, defanged):

How to read these: the IPs will age; the archive-account and cron patterns are durable and worth turning into detection rules. Any match means assume full appliance compromise and assume mail left the building.

Enterprise Impact: What’s Actually at Risk

Mail content: An archive destination receives copies of messages. If one was added on your appliance, treat all mail that passed through it since then as potentially exposed, including attachments and encrypted-mail workflows.

Appliance secrets: A configuration dump can hold directory-integration credentials, certificates and keys. Rotate them on any appliance with indicators.

Breach-notification clocks: Mail often carries regulated data. Confirmed archive exfiltration may start notification timelines under state law, SEC rules or sector regulators. Document when you found it and what you did.

Audit and insurance: A KEV-listed edge flaw remediated after the CISA deadline needs a clear record: when you applied the workaround, when you upgraded and what your compromise checks found.

What Security Leaders Should Do Next

Today

1. Inventory every FortiMail appliance, including DR and regional units, and record the exact build.
2. Preserve evidence first: export event, config, admin and encryption logs and back up the configuration.
3. Review archive accounts for any you did not create, especially archive234 or anything with a remote destination you don’t recognize. Remove and record them.
4. Upgrade to 8.0.2, 7.6.7 or 7.4.9 or later after confirming the build is published for your branch. Keep IBE disabled or the WAF rule in place until the upgrade is done.

Within 48 hours

1. Hunt the full indicator set: the two IPs in firewall and proxy logs, the seven files, the /migadmin cron entry and IBE encryption errors.
2. Check outbound traffic from FortiMail to unknown destinations, especially archive transfers.
3. If anything matches, run an incident: isolate, rebuild from a clean image rather than relying on the upgrade, rotate every credential and certificate the appliance held, and scope which mail was exposed.

Long-term

1. Alert on configuration changes to edge appliances, not just logins and files. A new archive or forwarding destination should page someone.
2. Keep management and webmail interfaces off the internet unless there is a documented business need.
3. Put mail gateways in your edge-device program with a named owner and pre-approved emergency change windows.

Winners and Losers

Final Executive Takeaway

The FortiMail patch is the easy part.

Fortinet’s own indicators show attackers using the product’s archiving feature as an exfiltration channel. That change sits in configuration, and configuration survives an upgrade.

Upgrade now. Audit the archive accounts. Assume mail left if you find one you didn’t create.

Frequently Asked Questions

Sources

Primary sources: Fortinet PSIRT advisory FG-IR-26-175 (initial publication October 1, solution update October 5); CISA Known Exploited Vulnerabilities catalog entry for CVE-2026-104286. Additional reporting reviewed: BleepingComputer, Field Effect, watchTowr and Hard2bit (patch-status and IoC analysis, single-source where noted). Reflects public reporting as of October 7, 2026.