FortiMail: Attacks on zero-day vulnerability underway, workaround available

Fortinet’s FortiMail security appliances are currently under attack on the internet. Cybercriminals can exploit the zero-day vulnerability in FortiMail to fully compromise the devices – without prior authentication. Updates are still pending, but Fortinet has provided temporary countermeasures and indicators of successful attacks.

The US cybersecurity authority CISA is also warning the exploitation of the FortiMail vulnerability CISA . Fortinet has published its security advisory , which contains some helpful information for administrators. The vulnerability is a so-called path traversal flaw. Due to insufficient filtering of NULL characters, attackers from the internet can write arbitrary files to the operating system without prior authentication using carefully crafted HTTP or HTTPS requests (CVE-2026-104286, CVSS 9.8 , Risk “ critical ”). As a result, they can inject and execute malicious code and take control of the appliance. Fortinet’s own Product Security team discovered the vulnerability.

The FortiMail software branches 8.0 up to and including 8.0.1, 7.6 up to 7.6.6, 7.4 up to 7.4.8, and 7.2 up to 7.2.9 are affected. Those using the 7.2 version should migrate to the 7.4 branch. For the newer branches, Fortinet only announces an upcoming update; updates to close the vulnerability are not yet available.

However, administrators can help themselves by disabling the identity-based encryption (IBE) function of their FortiMail appliance. According to the security advisory, the following commands on the command line are sufficient:

config system encryption ibe set status disable end

Alternatively, access to the FortiMail management interface from the internet should be disabled or limited to trusted private networks (VPNs). Fortinet also lists indicators of compromise (IOCs) that administrators can use to check if their appliance has already been compromised.

Fortinet appliances secure the network borders of mostly larger companies and are therefore quickly targeted by cybercriminals if vulnerabilities within them are easily exploitable. In mid-June this year, for example, it became known that a large-scale attack on Fortinet firewalls was underway . Around 74,000 devices are said to have been compromised. Among other things, the attackers tried 1.16 billion combinations of login credentials (so-called credential stuffing). However, it remained unclear how exactly they gained access to the devices.

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.