FortiMail CVE-2026-104286: Path Traversal and NULL Byte Flaw Exploited for Arbitrary File Writes

1. Basic Information

• Original Title: Improper limitation of a pathname to a restricted directory
• Source: Fortinet PSIRT
• Published: October 1, 2026
• Updated: None
• Severity: Critical
• Severity Basis: CVSS score of 9.8 with no authentication required. Fortinet confirmed active exploitation, and CISA added the vulnerability to its KEV catalog. Patches for multiple branches are not yet available at the time of publication, requiring isolation of the webmail interface (IBE path), disabling IBE, and conducting IoC investigations.
• Primary Source: Fortinet PSIRT FG-IR-26-175
• Related Sources: BleepingComputer, CISA KEV Catalog, CISA KEV official data
• Associated Malware: None
• Associated Threat Groups: None
• Associated CVE: CVE-2026-104286
• Related Products: FortiMail 8.0, FortiMail 7.6, FortiMail 7.4, FortiMail 7.2

2. Executive Summary

CVE-2026-104286 in FortiMail allows unauthenticated attackers to write arbitrary files using crafted HTTP(S) requests that exploit path traversal and NULL byte handling flaws. Fortinet has reported active exploitation and released temporary mitigation guidance for the webmail IBE path, along with IoCs including IP addresses, cron jobs, and archive settings.

3. Attack Flow

Phase 1: From Unauthenticated File Write to System Modification

1. An attacker accesses the FortiMail webmail interface (IBE path) and sends a crafted HTTP(S) request containing path traversal sequences and a NULL byte.
2. Successful exploitation allows the attacker to write arbitrary files on the underlying system.
3. BleepingComputer cited Fortinet IoCs involving the addition or modification of files such as liblog.so, webconsole, mailservice, httpd.conf, ld.so.preload, and migadmin archives. The exact role and execution order of each file remain undetermined.
4. Public logs indicate that a root-level cron job invoked commands related to /migadmin. Complete command arguments and final execution results are not shown, meaning successful execution or persistence across all files cannot be globally confirmed.

Flow 2: Remote Archive Configuration — The Link to Initial Exploitation Is Undocumented

1. Public logs show that user admin used the CLI to add archive234 to the mail archive account settings, specifying a remote server at 79[.]141.169.187 and the directory /uploads. Here, archive234 serves as the archive setting name and remote connection username, rather than a FortiMail administrator account.
2. Inference: This configuration could be used to exfiltrate email archives externally, but public information does not confirm successful transmission or transferred data volume.

4. Attacker Positioning and Execution Location

• Remote, unauthenticated attackers with HTTP or HTTPS access to the FortiMail webmail interface (IBE path).
• Subsequent operations execute locally on the FortiMail appliance.

5. Visibility for Victims and Administrators

Victims

• No visual changes are reported for standard email users. Impact may manifest as operational anomalies in mail delivery or the management console.

Administrators

• Indicators of compromise include the addition or modification of specific files, root-level cron jobs, administrator logouts, newly added archive accounts, Base64 errors related to IBE, failed login logs, and network traffic communicating with public IoC IP addresses.

6. Conditions for Success and Failure

Success Conditions

• The vulnerable FortiMail version has the IBE path enabled, and the attacker has network reachability to the webmail interface.
• The crafted HTTP(S) request is successfully processed to write arbitrary files.
• Subsequent code execution requires a written payload to be loaded and executed, or a configuration change to cause attacker-controlled code to run through a loader, service, or cron job. Arbitrary file write alone does not establish that code execution occurred.

Failure Conditions

• Upgrade to a patched release when available. At the time of review, Fortinet listed 7.4.9, 7.6.7, and 8.0.2 as upcoming fixes for their respective branches and recommended those versions or later releases within each branch. FortiMail 7.2 users must migrate to branch 7.4 or later and select a release that meets the fixed-version requirement for the destination branch.
• Official temporary mitigation is to disable IBE. Alternative mitigations include restricting access to the webmail interface from the internet, limiting access to trusted private networks, or deploying a front-end WAF to block POST requests to /ibe containing ../. Restricting access to the admin login screen alone may not block the IBE path.
• Investigate matches to published IoCs and isolate appliances suspected of compromise. Preserve evidence and assess whether rebuilding is required.

7. Impact of Successful Exploitation

• Arbitrary file writes on the FortiMail appliance.
• Public IoCs show modified files and settings, alongside logs of root-level cron jobs invoking commands. The success of individual loaders and persistence mechanisms requires individual verification.
• Potential Impact: External transmission of email archives. Successful transmission and transferred data volumes remain unverified.

8. Observable Logs

Email

• Check archive account configurations, email archive transmission history, and anomalies in queues or delivery.

Proxy / SWG / DNS

• Review HTTP(S) requests from unknown sources targeting the webmail interface (IBE path), and appliance outbound traffic communicating with public IoC IP addresses.

Endpoint / EDR

• Inspect public file paths and hash values, ld.so.preload, httpd.conf, /migadmin, /bin/smit, root-level cron jobs, and active service processes.

Identity / IdP

• Review local administrator logins and logouts, CLI additions or modifications of archive account settings, and failed login logs. Do not treat archive234 as an administrator account name. If integrated with an external IdP, cross-reference sign-in events at the same timestamp.

SaaS / Cloud

• Check configuration drift, administrator accounts, archive destinations, and IBE settings across centralized management systems and backups.

Network

• Monitor connections to 79[.]141.169.187 and 45[.]129.0.192, data transfers targeting /uploads, and unknown outbound traffic.

9. Attack Success Assessment

Initial Execution Confirmation

• Public Information and Criteria: Public Information: Fortinet reported active exploitation and arbitrary file writes, publishing logs of root-level cron jobs launching /migadmin-related commands. Assessment Criteria: Separate unauthorized file creation and modification from code execution; verify execution using attacker-originated commands or loader activity observed in processes and audit records. Do not assume successful execution based solely on file names, errors, or observed requests, and verify differences against a clean image baseline.
• Scope: FortiMail appliances
• Associated CVE: CVE-2026-104286

Information Theft or Session Compromise Confirmation

• Public Information and Criteria: Public Information: While logs show remote destinations configured for archive234, actual data exfiltration (data leakage) remains unconfirmed. Assessment Criteria: Verify evidence corresponding to archive file generation, transmission sessions, network transfer volumes, and remote receipt.
• Scope: FortiMail email archives
• Associated CVE: CVE-2026-104286

10. Investigation Playbook

Trigger

• Focus on affected versions, internet exposure status, public IoCs (files/hashes/IPs), archive234, /migadmin-related cron jobs, and IBE errors.

Initial Review

• Verify software versions, patch status, webmail/IBE exposure scope, IBE configurations, log retention policies, public IoCs, and update timestamps.

Endpoints

• Preserve appliance images and logs, checking public paths and hashes, ld.so.preload, httpd.conf, cron jobs, active processes, and package differences.

Authentication and Cloud

• Inspect administrator and CLI sessions, archive accounts, credentials, certificates, encryption keys, and operations within centralized management systems.

Subsequent Operations

• Trace remote archive transmissions, access to email data, outbound communications, and credential reuse against connected destinations.

Containment

• Isolate the webmail interface (IBE path) and disable IBE. Upgrade to a patched version after preserving forensic evidence, rebuild compromised appliances from clean images, and rotate credentials and encryption keys.

Classification

• Categorize and record exploitation attempts, file writes, code execution, persistence, archive settings, and data exfiltration separately.

11. Defense and Detection Ideas

Single Events

• Treat the creation or modification of ld.so.preload, files matching public hashes, configuration additions for archive234, and root-level execution of /migadmin-related cron jobs as high-priority indicators.

Timeline Correlation

• Correlate HTTP(S) requests to webmail/IBE -> IBE errors/file writes -> loader or configuration modifications -> cron command execution -> archive destination configuration -> outbound communication as an integrated attack chain.

Threat Hunting Perspective

• Search all FortiMail instances for public IoCs, retrospectively reviewing webmail/IBE access and outbound communications prior to patch deployment.

Log Gaps

• HTTPS payloads, internal appliance processes, and actual archive transfers may not be fully logged. Combine network flow analysis, configuration backups, and filesystem diffs to investigate.

Prioritized Mitigations

• Prioritize isolating the webmail interface (IBE path), disabling IBE, triaging IoCs, applying patches, rebuilding compromised systems, and rotating credentials and encryption keys.

12. Facts, Inference, and Hypothesis

Facts

• CVE-2026-104286 involves a path traversal vulnerability (CWE-22) and a NULL byte handling flaw (CWE-158) in the FortiMail webmail interface (IBE path), allowing unauthenticated attackers to write arbitrary files via crafted HTTP/HTTPS requests.
• Affected versions include 8.0.0 to 8.0.1, 7.6.0 to 7.6.6, 7.4.0 to 7.4.8, and 7.2.0 to 7.2.9. Official fix levels are planned for 7.4.9, 7.6.7, 8.0.2, and later (noted as upcoming at the time of review). Migrations from 7.2 to 7.4 or later must also satisfy the specific patch level within the target branch.
• BleepingComputer cited Fortinet IoCs including hash values for added files (/data/lib/liblog.so, /data/bin/webconsole, /data/bin/mailservice, /data/etc/ld.so.preload) and modified files (/bin/smit, /data/etc/httpd.conf, /data/migadmin.tar.gz). This file list is based on secondary reporting and was not independently confirmed in the primary advisory text.
• Published log examples include root cron command invocations related to /migadmin, an administrator logout with ui=(null), and an archive configuration named archive234 specifying remote server 79[.]141.169.187, remote username archive234, and directory /uploads. The examples also include IBE decryption errors and failed logins. The archive configuration log does not demonstrate that a transfer completed.
• Fortinet's temporary mitigation is to disable IBE. Alternative recommendations include restricting external access to webmail or deploying a front-end WAF to block POST requests to /ibe containing ../.
• Fortinet has not disclosed the timing of initial exploitation, the number of affected systems, or the threat actor.
• CISA added the vulnerability to its KEV catalog on October 1, 2026. The entry lists October 4, 2026 as the Due Date, marks forensic triage under BOD 26-04 as Yes, and lists known use in ransomware campaigns as Unknown. Unknown refers specifically to ransomware use; exploitation of the vulnerability in the wild has been confirmed.

Inference

• The remote transmission setting for archive234 suggests preparation or execution of data transmission, but public logs alone cannot confirm whether archive data was actually transmitted, nor the volume and content.
• Modifications to ld.so.preload and httpd.conf following arbitrary file writes could be leveraged for process hijacking or persistent code execution. The exact role of each IoC cannot be fully determined from public data alone.

Hypothesis

No additional hypotheses. Unverified items are documented in Section 14, Unresolved Questions and Further Investigation.

13. MITRE ATT&CK Mapping

ID	Technique	Confidence	Basis
T1190	Exploit Public-Facing Application	high	Fortinet confirmed active exploitation via unauthenticated HTTP(S) requests targeting the webmail interface (IBE path).
T1574.006	Hijack Execution Flow: Dynamic Linker Hijacking	medium	Inferred mapping based on the addition of ld.so.preload and placement of liblog.so from IoCs cited by BleepingComputer. Individual file roles and loader execution remain unconfirmed.
T1053.003	Scheduled Task/Job: Cron	high	Fortinet log examples show root-level cron jobs executing /migadmin-related commands.

14. Unresolved Questions and Further Investigation

• Specific paths, parameters, and file contents of exploitation requests.
• Functional details of public IoC files, initial exploitation timing, number of affected organizations, and threat actors.
• Confirmation of whether archive data was actually transmitted, along with transfer volume and contents.
• General availability timing for versions 7.4.9, 7.6.7, and 8.0.2, and post-application forensic procedures.

15. Impact on SOCs and Organizations

Because FortiMail operates at the email perimeter, compromise may affect email archives, credentials, and configuration. Japanese organizations should isolate the webmail interface (IBE path), disable IBE while awaiting patches, and retrospectively review published IoCs, archive settings, cron activity, and outbound communications. Assess whether compromise has occurred while applying these mitigations.

16. Summary by Role

• SOC: Correlate published hash values, file paths, archive234, 79[.]141.169.187, 45[.]129.0.192, /migadmin-related cron jobs, and IBE errors to trace attacks from file writes through to archive transmission.
• Administrators: Remove internet access to the webmail interface (IBE path) and disable IBE. Check patch availability and upgrade when a suitable patched release becomes available. After preserving evidence, consider rebuilding appliances suspected of compromise and rotating credentials and cryptographic keys.
• Users: No action is required from standard users. Follow instructions if notified of temporary mail service suspensions or re-authentication requests.