Grade One Press

Technology reporting you can check

News · Security & privacy

Attackers are exploiting a FortiMail flaw before a fix exists; US agencies get three days to act

Fortinet says an unauthenticated attacker can write files on its email-security appliances. Fixed releases are listed as upcoming, so for now it offers a workaround: switch off one feature.

Grade One Newsroom · 1 min read

Sources: 3 · top grade 1How evidence is graded

An exploited FortiMail flaw has no fixed release yet, only a workaround

Grade 3 · Filed record

Source: Fortinet

What changed
Fortinet said on 1 October that CVE-2026-104286 in FortiMail is being exploited. CISA listed it the same day, with a 4 October deadline for US agencies.
Who it affects
Organisations running FortiMail 7.2 to 8.0.1. Fortinet's workaround is to turn off its IBE encryption service, or keep webmail off the open internet.
What it does not tell you
How many appliances are exposed or compromised, or who is behind the attacks. Neither Fortinet nor CISA says.

The full story Check the source

Fortinet said on 1 October that attackers are exploiting a flaw in FortiMail, its email-security appliance. The flaw "may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests" [1].

The US Cybersecurity and Infrastructure Security Agency added the flaw, CVE-2026-104286, to its catalogue of exploited vulnerabilities the same day. It gave federal agencies until 4 October to act [2].

There is no fixed software yet. Fortinet's advisory lists the fixed releases as "upcoming" and urges customers to apply a workaround [1].

Fortinet rates the flaw 9.8 out of 10. It is the only score in the US vulnerability database's record [3].

What it covers

FortiMail 8.0.0 to 8.0.1, 7.6.0 to 7.6.6, 7.4.0 to 7.4.8 and 7.2.0 to 7.2.9. Users of 7.2 are told to move to 7.4 or later [1].

The workaround is to switch off FortiMail's IBE service, its identity-based encryption for email. Alternatively, keep the webmail interface off the internet, or have a web application firewall block requests to /ibe that contain "../" [1].

Fortinet found the flaw itself, and its advisory lists two IP addresses and log entries to look for as signs of compromise [1]. CISA tells agencies to follow its forensic triage requirements, and to stop using the product where mitigations are unavailable [2].

What it does not tell you

How many appliances are exposed or have been compromised, or who is behind the attacks. Neither Fortinet nor CISA says [1][2].

When the fixed releases will come. The advisory gives no date [1].

Sources and their grades

  1. Fortinet, Improper limitation of a pathname to a restricted directory (FG-IR-26-175). Read 3 October 2026. Grade 3 · Filed record Published 1 October 2026. The maker's own account of its product: affected releases, the workaround, and signs of compromise.
  2. US Cybersecurity and Infrastructure Security Agency (CISA), Known Exploited Vulnerabilities Catalog, entry CVE-2026-104286. Read 3 October 2026. Grade 1 · Primary Added 1 October 2026, due 4 October. A listing means CISA has evidence of exploitation.
  3. US National Vulnerability Database (NIST), CVE-2026-104286. Read 3 October 2026. Grade 1 · Primary Published 1 October 2026. The only severity score in the record is Fortinet's own.

A grade says how much weight a source will take, from 1 (a body that can compel an answer and has nothing to sell) to 5 (somebody describing what they sell, or themselves). The standard sets out what each grade may be used for.

Filed under Network security Vulnerabilities

Comments

Commenting needs an account, made with nothing but an email address. A first comment is read before it appears.

More news

See all