FortiMail email gateways hijacked through the encryption service without a login (CVE-2026-104286)

25 October 2026Critical 9.8Being exploited

Fortinet · FortiMail · CVE-2026-104286

FortiMail email gateways hijacked through the encryption service without a login

A path traversal flaw in FortiMail lets an unauthenticated attacker write files to the appliance using crafted web requests to its identity-based encryption (IBE) service. Fortinet says it has been exploited in the wild, and its indicators include an unexpected archive account being added that copies mail to a remote destination.

Affected: FortiMail 8.0.0 to 8.0.1, 7.6.0 to 7.6.6, 7.4.0 to 7.4.8 and 7.2.0 to 7.2.9. FortiMail Cloud was fixed by Fortinet on 5 October.
What to do: Upgrade to FortiMail 8.0.2, 7.6.7 or 7.4.9 or above; on 7.2, move to branch 7.4 or above. Until then, turn off the IBE service or keep the webmail interface off the internet. Check for unfamiliar archive accounts.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.
Why it’s here: Exploited; on CISA's KEV list; a compromised mail gateway can quietly copy a company's email.

FortiMail email gateways hijacked through the encryption service without a login

Affected

FortiMail 8.0.0 to 8.0.1, 7.6.0 to 7.6.6, 7.4.0 to 7.4.8 and 7.2.0 to 7.2.9. FortiMail Cloud was fixed by Fortinet on 5 October.

What to do

Upgrade to FortiMail 8.0.2, 7.6.7 or 7.4.9 or above; on 7.2, move to branch 7.4 or above. Until then, turn off the IBE service or keep the webmail interface off the internet. Check for unfamiliar archive accounts.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.

Why it’s here

Exploited; on CISA's KEV list; a compromised mail gateway can quietly copy a company's email.