CVE Tools
Track your stack
A rack-mounted email security appliance in a dim data center, half its status lights amber, a technician's hand reaching toward it with a USB drive — no logos or on-screen text

Fortinet Patched FortiMail's Zero-Day on Three Branches. The Other Two Are Never Getting One.

CVE-2026-104286 let anyone write files to FortiMail with no login. Five weeks after CISA's three-day deadline, the 7.2 and 7.0 branches are still unpatched — and Fortinet's guidance is to migrate off them, not wait for a fix.

CVE Tools4 min read

CVE-2026-104286In CISA KEVEPSS today 4.6%, 92nd percentileCVSS 9.8Open the record

Fortinet's October patch run for CVE-2026-104286 only closed two-thirds of the hole. Three FortiMail branches — 8.0, 7.6 and 7.4 — got real fixed builds within days of CISA adding the flaw to its Known Exploited Vulnerabilities (KEV) catalog. The other two, 7.2 and 7.0, were told to migrate to a newer branch instead. Five weeks past the federal government's three-day remediation deadline, anyone still running FortiMail 7.2 or 7.0 is sitting on an unauthenticated, CVSS 9.8 arbitrary-file-write bug with no patch coming for that version — ever.

9.8CVSS base scoreAV:N/AC:L/PR:N/UI:N — no login, no interaction
4.6%EPSS score91st percentile, despite confirmed in-the-wild exploitation
3 of 5affected branches with a real fix8.0, 7.6, 7.4 — not 7.2, not 7.0
0public PoCs or scanner modulesas of Nov 7, five weeks post-disclosure
CVE-2026-104286An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4...EPSS 4.6%CVSS 9.8

Scores as of November 7, 2026live record →

The bug itself is simple to describe: FortiMail's webmail Identity-Based Encryption (IBE) feature mishandles file paths and NULL bytes in incoming HTTP/HTTPS requests, so an unauthenticated attacker can get the appliance to write a file outside its intended directory. Fortinet's own CWE record lists this as CWE-22 (path traversal); several vendor-adjacent write-ups also describe a NULL-byte-handling component, but that second weakness isn't reflected in the published NVD/CVE.org record we track — so we're flagging it as unconfirmed rather than asserting a CWE we can't verify ourselves.

Three branches fixed. Two told to leave.

BranchAffected versionsCurrent fix status
8.08.0.0 – 8.0.18.0.2 — shipped Oct 5, 2026
7.67.6.0 – 7.6.67.6.7 — shipped Oct 5, 2026
7.47.4.0 – 7.4.87.4.9 — shipped Oct 5, 2026
7.27.2.0 – 7.2.9No dedicated fix — Fortinet's guidance: "upgrade to 7.4 or above"
7.0all versionsNo dedicated fix — Fortinet's guidance: "migrate to a fixed release"

From disclosure to now

  1. FG-IR-26-175 published; CISA adds the CVE to KEV the same day
    Credited to Fortinet's own Gwendal Guégniaud, but already flagged as exploited in the wild at disclosure — an internally found zero-day.
  2. CISA's federal remediation deadline (BOD 26-04) passes
    Three days after KEV addition. No fixed build existed yet for any branch.
  3. Fixed builds ship for three branches
    8.0.2, 7.6.7 and 7.4.9 become available; FortiMail Cloud patched the same day.
  4. Advisory's last update to date
    Confirms FortiMail Cloud needs no customer action. No further revision since.
  5. 7.2 and 7.0 remain without a dedicated fix
    Five weeks after the federal deadline, guidance is still "migrate," not "patch."

Why EPSS still calls this a 4.6% risk

EPSS model
  • Predicts ~4.6% probability of exploitation in the next 30 days
  • 91st percentile among all scored CVEs — high, but far from exceptional
  • Trained on signals like public PoC code and exploit chatter
Those signals don't exist yet for this CVE — there still isn't a public PoC.
CISA KEV
  • Added the same day as disclosure, Oct 1
  • Based on confirmed evidence of in-the-wild exploitation, not a forecast
  • Triggers a binding remediation deadline for federal agencies
KEV answers a different question than EPSS: not "how likely," but "already happening."
Fortinet CVEs added to CISA's KEV, by publish year
2019520202202102022220233202442025720269
LabelValue
20195
20202
20210
20222
20233
20244
20257
20269
CVE-2026-104286 is Fortinet's 9th KEV addition so far in 2026 — already the highest yearly total we have on record, with two months of the year still left.

What Fortinet's advisory says to check right now

  • Outbound connections from the FortiMail management interface to 79.141.169.187 or 45.129.0.192
  • A FortiMail admin/archive account named archive234 you did not create
  • Cron entries referencing /migadmin that you did not schedule
  • IBE decrypter errors reading "BufferException: Invalid Base64 Encoding at pos 0"
  • Failed internal login attempts for a wildcard (*) user address
Fastest mitigation if you can't patch today
# config system encryption ibe#  set status disable# end
  1. If you're on 8.0, 7.6 or 7.4: upgrade to 8.0.2, 7.6.7 or 7.4.9 — the actual fix.
  2. If you're on 7.2 or 7.0: there is no patched build for your branch. Move to 7.4 or later; Fortinet is not planning to issue one.
  3. Until upgraded: disable IBE (above), or pull the webmail/management interface off the public internet.
  4. Running a WAF in front of FortiMail? Block POST requests to /ibe containing "../" as a stopgap.
  5. Check the indicators list against your logs regardless of patch status.
Is CVE-2026-104286 patched?
Partially. Fortinet shipped fixed builds for the 8.0, 7.6 and 7.4 branches on Oct 5, 2026. FortiMail 7.2 and 7.0 have no dedicated fix — Fortinet's guidance is to move to 7.4 or later.
Is there a public exploit for this?
Not as of this writing. Our own tracking for CVE-2026-104286 shows zero public PoCs and no Metasploit or Nuclei module, despite Fortinet and CISA confirming active exploitation before the advisory was even published.
Why does EPSS score this so low if CISA confirms it's being exploited?
EPSS predicts future exploitation probability from signals like public PoC code and exploit chatter — signals this CVE doesn't have yet. KEV is based on confirmed activity, not prediction. For a freshly disclosed, PoC-free KEV entry, trust KEV over EPSS for triage.

Fortinet has nine CVEs in CISA's KEV catalog so far this year — see its vendor history on cve.tools — against a backdrop of overall vulnerability trends that keep bending toward exploited-before-disclosed. This one is a reminder that "patched" is a per-branch claim, not a per-product one: check which build you're actually running before you cross a KEV entry off your list.

Patch status confirmed 2026-11-07live record →

Sources: Fortinet PSIRT advisory FG-IR-26-175; CISA Known Exploited Vulnerabilities Catalog entry for CVE-2026-104286; CVE.org record for CVE-2026-104286.