FortiMail’s Recovery Still Needs Evidence
Vendor-reported exploitation involves CVE-2026-104286, rated 9.8. Directory-boundary and zero-byte-handling weaknesses let attackers write chosen files through manipulated HTTPS or HTTP traffic without authenticating.
Correction, 21 October 2026: The record, initially published 1 October and dated 7 October, replaces upcoming labels with fixed builds. It reports Cloud remediation on 5 October using the first two corrected builds below; those customers need no advisory action. Self-managed appliances and prior compromise remain separate questions.
Update, 1 November 2026: Fortinet’s advisory page and its original CVE record, updated on 28 October, still describe 7.2.10 as upcoming. Its CSAF document, dated 28 October, instead directs the 7.2 branch to 7.4 or above. The first corrected 8.0, 7.6 and 7.4 releases agree across those sources. An upcoming label does not verify that a 7.2.10 build is available. Confirm the supported route with Fortinet before selecting that branch’s remediation.
Match the installed branch to a fixed build
| Installed release | Minimum corrected build |
|---|---|
| 8.0.0–8.0.1 | 8.0.2 |
| 7.6.0–7.6.6 | 7.6.7 |
| 7.4.0–7.4.8 | 7.4.9 |
| 7.2.0–7.2.9 | CSAF: move to a corrected 7.4-or-later branch. The advisory page and CVE record still describe 7.2.10 as upcoming. |
| 7.0, all versions | Migrate to a fixed release, as the advisory page directs. |
Contain the route, preserve the investigation
For the command-line workaround, open the appliance’s encryption configuration for IBE, deactivate that feature and close the block. The vendor’s complete instructions supply the executable block and equivalent web-console control. This prose is not an executable command.
Deny public webmail access, restrict it to approved internal networks, or have a fronting WAF drop POST /ibe requests containing ../. The vendor leaves enabling conditions unspecified.
The record now supplies network-address and log indicators. An absent match cannot establish that the appliance was clean.
CISA’s forensic guidance connects scoping, evidence collection, urgent patching, containment, analysis and escalation. Preserve relevant material before changes where possible, then investigate rather than closing the case when the mitigation ticket succeeds. Its suggested stage timings are recommendations, not separate mandatory deadlines.
Record the owner, exposure, retained evidence and unresolved questions. Completing containment leaves recovery unproven. Our earlier pivot report concerns a different incident, but reinforces the need to check what happened before a route was closed.
Read the federal date in context
The current KEV entry was added on 1 October, shows a 4 October due date and requires forensic triage. In-scope US federal civilian agencies must check the directive’s phase and exposure rules when determining each asset’s deadline. Other organisations do not automatically inherit that federal deadline.
Sources and chronology
The revision timeline remains incomplete. The federal catalogue was checked against version 2026.10.20. Reported exploitation does not supply the time of the latest attack.
