CVE-2026-104286: 
Fortimail Análisis y mitigación de vulnerabilidades

CVE-2026-104286 is a critical path traversal vulnerability (CWE-22) combined with an improper neutralization of NULL byte/character (CWE-158) in Fortinet FortiMail that allows unauthenticated remote attackers to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. Affected versions include FortiMail 7.2.0–7.2.9, 7.4.0–7.4.8, 7.6.0–7.6.6, and 8.0.0–8.0.1; FortiMail 7.0.x is also affected per NVD data. The vulnerability was publicly disclosed on October 1, 2026, and was immediately added to CISA's Known Exploited Vulnerabilities (KEV) catalog the same day due to confirmed in-the-wild exploitation (FortiGuard Advisory, CISA KEV). It carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory).

The vulnerability stems from two compounding weaknesses: improper limitation of a pathname to a restricted directory (CWE-22) and improper neutralization of NULL bytes (CWE-158) in FortiMail's IBE (Identity-Based Encryption) feature, specifically the /ibe endpoint. An unauthenticated attacker can craft HTTP or HTTPS POST requests containing path traversal sequences (e.g., ../) combined with NULL byte injection to bypass input validation and write arbitrary files to any location on the underlying filesystem (FortiGuard Advisory). The attack requires no authentication, no user interaction, and is network-accessible, making it fully automatable. Technical analysis from researchers indicates the vulnerability involves null-byte manipulation to truncate file extensions and escape the intended directory boundary, enabling placement of web shells or malicious scripts (Rescana, Truesec).

Successful exploitation allows an unauthenticated attacker to write arbitrary files anywhere on the FortiMail system, which in practice enables remote code execution — for example, by placing a web shell in a web-accessible directory. This results in full confidentiality, integrity, and availability compromise of the affected email gateway, including potential access to email content, credentials, and configuration data (FortiGuard Advisory). Because FortiMail acts as an email security gateway, compromise can facilitate lateral movement into internal networks, interception of sensitive communications, and use of the appliance as a pivot point for further attacks. The CISA KEV listing notes the vulnerability is associated with potential ransomware campaign use (CISA KEV).

CVE-2026-104286 was exploited as a zero-day — active exploitation was confirmed before patches were available for most branches, and CISA added it to the KEV catalog on October 1, 2026, with a three-day remediation deadline for federal agencies (CISA KEV). Exploitation has been reported by multiple threat intelligence sources including watchTowr and BleepingComputer, with observed attacker IPs including 79[.]141.169.187 and 45[.]129.0.192 (FortiGuard Advisory, BleepingComputer). A fake PoC repository (ShadowForge-Cyber/CVE-2026-104286-POC) was flagged as a scam with no actual exploit code; however, a separate PoC (0xREBYTE/CVE-2026-104286-PoC) appeared on GitHub around October 13, 2026. The EPSS score is approximately 2.2% (82nd percentile), and NVD classifies exploitation as active and automatable (GitHub Advisory). No specific threat actor attribution has been publicly confirmed.

1. Reconnaissance: Use Shodan, Censys, or similar tools to identify internet-facing FortiMail instances (fingerprinting via HTTP banners or login pages). Researchers identified approximately 3,911 FortiMail fingerprints exposed on the internet.
2. Identify vulnerable version: Confirm the target is running FortiMail 7.2.0–7.2.9, 7.4.0–7.4.8, 7.6.0–7.6.6, or 8.0.0–8.0.1 via version disclosure in HTTP headers or login pages.
3. Target the IBE endpoint: Send a crafted HTTP or HTTPS POST request to the /ibe endpoint on the FortiMail webmail interface, which handles Identity-Based Encryption operations and is accessible without authentication.
4. Inject path traversal payload: Include a path traversal sequence (e.g., ../../) combined with a NULL byte (%00) in the filename or path parameter to bypass directory restriction checks and file extension validation, escaping the intended upload directory.
5. Write malicious file: The crafted request causes the server to write an attacker-controlled file (e.g., a web shell) to a web-accessible directory on the FortiMail system.
6. Achieve code execution: Access the dropped web shell via HTTP to execute arbitrary OS commands as the FortiMail service account, enabling persistence, credential harvesting, lateral movement, or ransomware deployment (FortiGuard Advisory, Truesec).

• Network: Inbound HTTP/HTTPS POST requests to /ibe endpoints containing ../ path traversal sequences; outbound connections from the FortiMail server to suspicious external IPs, particularly 79[.]141.169.187 and 45[.]129.0.192 (FortiGuard Advisory).
• System Event Logs: Log entries matching: type=event subtype=system pri=debug user=system ui=cron msg="(root) CMD (/bin/sh -c 'O=/migadmin ..." indicating cron-based command execution; type=kevent subtype=config ... msg="Added 'archive234' to 'archive account'...remote-ip[79.141.169.187]" indicating unauthorized archive account creation with exfiltration destination (FortiGuard Advisory).
• Encryption Logs: Entries such as FortiMail::IBE::DecrypterMediaIn::DecrypterMediaIn(...): Caught BufferException(2), BufferImpl.cpp:973, 'Invalid Base64 Encoding at pos 0. Character=0x2a' indicating malformed IBE requests; Internal user *@domain.tld failed to log in indicating probing activity (FortiGuard Advisory).
• File System: Unexpected files (e.g., web shells) written outside the IBE upload directory; new or modified files in web-accessible directories of the FortiMail installation.
• Process: Unusual child processes spawned by the FortiMail web service (e.g., /bin/sh, curl, wget) or unexpected cron job modifications.

Fortinet released patches on October 5, 2026: upgrade to FortiMail 8.0.2 or above, 7.6.7 or above, 7.4.9 or above, or migrate from 7.2.x to branch 7.4 or above. FortiMail Cloud was automatically updated to v7.6.7 GA or v8.0.2 GA on October 5, 2026, requiring no action from cloud customers (FortiGuard Advisory). For organizations unable to patch immediately, Fortinet recommends the following workarounds (in order of preference):

• Disable the IBE feature via GUI (Encryption → IBE → IBE Service 'off') or CLI: config system encryption ibe / set status disable / end
• Disable or restrict internet access to the FortiMail webmail interface, limiting it to trusted private networks only
• If a WAF is deployed in front of FortiMail, configure rules to block POST requests to /ibe containing ../

CISA required federal agencies to apply mitigations by October 4, 2026 (CISA KEV). Post-patching forensic triage is recommended given confirmed active exploitation.

Fortinet's PSIRT issued advisory FG-IR-26-175 on October 1, 2026, explicitly acknowledging in-the-wild exploitation and urging immediate workaround application (FortiGuard Advisory). BleepingComputer, The Hacker News, SecurityWeek, and Cybersecurity Dive all covered the zero-day extensively, highlighting the unusual circumstance of CISA adding the CVE to the KEV catalog on the same day as disclosure — before patches were available for most branches (BleepingComputer). The security community on Reddit (r/SecOpsDaily, r/linuxadmin) and Mastodon expressed concern about the tight three-day federal remediation deadline given the lack of patches at initial disclosure. watchTowr published an FAQ on the vulnerability, and multiple MSSPs (eSentire, Truesec, Integrity360, Beazley) issued emergency advisories to clients. The Canadian Centre for Cyber Security (CCCS), Hong Kong CERT, Singapore CSA, and Ireland NCSC all issued national-level advisories, reflecting the global severity assessment (Canadian CCCS).