FortiMail CVE-2026-104286 (FG-IR-26-175, unauthenticated arbitrary file write, exploited zero-day, CISA KEV): which versions are affected and how do I mitigate it?

Am I affected? Yes if you run a FortiMail email security gateway on: - 8.0.0-8.0.1 - 7.6.0-7.6.6 - 7.4.0-7.4.8 - 7.2.0-7.2.9 and 7.0.0-7.0.9 CVE-2026-104286 (CVSS 9.8) is a path traversal reachable through the Identity-Based Encryption (IBE) web feature. It lets an attacker without credentials write files on the appliance. Fortinet disclosed it on October 1, 2026 as already exploited, and CISA added it to KEV the same day. Fortinet's advisory is FG-IR-26-175. How to check: - get system status on the CLI, or the dashboard in the GUI, shows the firmware version. - Check whether IBE is enabled and whether the webmail/IBE interface is reachable from the internet. Fix: - Upgrade to the fixed releases Fortinet named: 8.0.2, 7.6.7 or 7.4.9 (or later). Check FG-IR-26-175 for current availability on your branch. - 7.2 and 7.0: no fix on those branches; move to 7.4.9 or later. Interim mitigation (Fortinet's workarounds until you can upgrade): - Disable the IBE feature if you don't need it. - Restrict or disable internet access to the FortiMail webmail interface. - Keep the management interface off the internet and allow it only from trusted internal networks. After fixing (assume compromise if IBE was exposed while unpatched): - Check the appliance against the indicators of compromise Fortinet published in FG-IR-26-175. - Look for unexpected files, admin accounts and configuration changes, including mail routing and forwarding rules an attacker could use to copy mail. - Rotate admin passwords and any credentials stored on the appliance (LDAP bind accounts, relay credentials, certificates). If compromise is confirmed, restore from a known-good image as Fortinet advises. Sources: https://www.helpnetsecurity.com/2026/10/02/fortinet-fortimail-vulnerability-cve-2026-104286/ https://www.bleepingcomputer.com/news/security/fortinet-warns-of-critical-fortimail-flaw-exploited-in-zero-day-attacks/ https://fieldeffect.com/blog/patches-pending-actively-exploited-fortimail-flaw