Full Report
A vulnerability has been discovered in Fortinet FortiMail that could allow for arbitrary code execution. Fortinet FortiMail is a secure email gateway that protects organizations from inbound threats including spam, phishing, malware, and business email compromise, while also preventing outbound data loss across physical, virtual, and cloud deployments. Successful exploitation of this vulnerability could allow an unauthenticated attacker to write arbitrary files to the underlying system, which could potentially lead to arbitrary code execution.
Analysis Summary
# Vulnerability: Fortinet FortiMail Arbitrary File Write and Remote Code Execution
## CVE Details
- **CVE ID:** CVE-2026-104286
- **CVSS Score:** Not explicitly listed in the source, but categorized as **Critical/High** impact due to unauthenticated RCE.
- **CWE:** Path Traversal (CWE-22) and NULL Byte Injection (CWE-158)
## Affected Systems
- **Products:** Fortinet FortiMail (Secure Email Gateway)
- **Versions:**
- 8.0.0 through 8.0.1
- 7.6.0 through 7.6.6
- 7.4.0 through 7.4.8
- 7.2.0 through 7.2.9
- **Configurations:** Systems with the GUI management interface reachable via HTTP or HTTPS.
## Vulnerability Description
A path traversal and NULL byte injection vulnerability exists in the publicly accessible web-based GUI of FortiMail. By sending specially crafted HTTP or HTTPS requests, an unauthenticated remote attacker can bypass security restrictions to write arbitrary files to the underlying operating system. This file write capability can be leveraged to achieve arbitrary command execution (RCE) on the host.
## Exploitation
- **Status:** **Exploited in the wild.** Fortinet has confirmed active exploitation.
- **Complexity:** Low (Targeting publicly reachable GUIs)
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Full system access possible)
- **Integrity:** High (Ability to write/modify files and execute commands)
- **Availability:** High (Potential for system takeover or service disruption)
## Remediation
### Patches
Fortinet recommends upgrading to the following versions (or higher) to resolve the flaw:
* **FortiMail 8.0.2** or later
* **FortiMail 7.6.7** or later
* **FortiMail 7.4.9** or later
* **FortiMail 7.2.10** or later
### Workarounds
* **Restrict Access:** Limit access to the FortiMail GUI management interface to trusted internal networks or management VLANs only. Avoid exposing the management portal to the open internet.
* **Apply Principle of Least Privilege:** Ensure administrative accounts and services run with the minimum necessary permissions.
## Detection
- **Indicators of Compromise:** Monitor web server logs for unusual HTTP/HTTPS requests containing path traversal patterns (e.g., `../`) or encoded NULL bytes (`%00`) directed at the GUI endpoints.
- **Detection methods and tools:** Utilize vulnerability scanners (e.g., Tenable, Qualys) to identify outdated FortiMail versions. Conduct manual penetration testing of the GUI interface to verify remediation.
## References
- **Vendor Advisory:** hxxps[://]fortiguard[.]fortinet[.]com/psirt/FG-IR-26-175
- **CVE Record:** hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-104286
- **MS-ISAC Advisory:** 2026-108