What happened
An internet-facing email appliance is under active attack
Fortinet disclosed CVE-2026-104286 on 1 October and reports active exploitation. The issue is an unauthenticated arbitrary-file-write vulnerability in FortiMail, rated CVSS 9.8. A crafted HTTP or HTTPS request can write files to an affected appliance, which can enable unauthorised code or command execution.
Do not wait for a routine patch window
Affected releases
Use Fortinet's exact fixed-release guidance
| FortiMail branch | Status reported in the advisory | Defender action |
|---|---|---|
| 7.2 | Affected; migrate to a supported fixed branch | Do not assume an in-branch update is available. Plan a supported migration and restrict exposure meanwhile. |
| 7.4 | Affected before 7.4.9 | Upgrade to 7.4.9 or later when released and verify the running build. |
| 7.6 | Affected before 7.6.7 | Upgrade to 7.6.7 or later when released and verify the running build. |
| 8.0 | Affected before 8.0.2 | Upgrade to 8.0.2 or later when released and verify the running build. |
Release availability can change quickly during an out-of-cycle advisory. Treat Fortinet's current advisory as the source of record for fixed builds and supported upgrade paths, and do not close the ticket merely because an update has been scheduled or downloaded.
First response
Preserve the investigation before changing the appliance
- 1
Identify every FortiMail instance. Inventory hardware, virtual, standby, and disaster-recovery appliances. Record version, management exposure, mail-flow role, log destination, and owner.
- 2
Reduce reachable attack surface. Remove public administration access where operationally possible and limit permitted source addresses at independent network controls. This reduces exposure but is not a repair.
- 3
Collect evidence before remediation. Export appliance, proxy, firewall, identity, and mail-flow logs. Preserve Fortinet's published indicators and relevant configuration state before restarting, upgrading, or rebuilding.
- 4
Apply the vendor fix and verify it. Install the correct fixed release or complete the required migration. Re-query each appliance after the change; a successful deployment job is not proof the active node is fixed.
- 5
Recover trust when exposure is credible. Review administrator accounts, API keys, mail routing rules, certificates, outbound connections, and configuration changes. Rotate or rebuild when integrity cannot be established.
Hunt
Look beyond the appliance's local logs
- Review web and reverse-proxy logs for unusual requests to the FortiMail GUI or management interfaces, especially from unrecognised sources during the pre-patch window.
- Compare administrator logins, configuration changes, mail-routing updates, new accounts, certificates, and scheduled jobs with approved change records.
- Correlate appliance events with firewall and DNS telemetry for unexpected outbound destinations, then examine affected mail flows for rule changes or forwarding anomalies.
- Keep the investigation bounded by evidence: public reporting confirms exploitation but does not establish that every vulnerable appliance has been compromised.
Defender note
Email security controls are high-trust systems
FortiMail is often positioned between the internet and an organisation's messaging estate. That makes compromise assessment broader than a software-version check: an affected appliance can influence mail flow, quarantine, routing, delivery decisions, and security telemetry. Build a recovery plan around the trust relationships the appliance holds, not only its operating-system image.