FortiMail had an unauthenticated file write. Fixes are out. Cloud is already moved.

Fortinet's FG-IR-26-175 covers CVE-2026-104286. Path traversal mixed with bad NULL-byte handling in the FortiMail GUI path. Unauthenticated HTTP or HTTPS can write arbitrary files on the appliance. Fortinet scores it 9.8 and says it has been exploited. CISA put it on KEV at the start of October with a short federal clock. The useful update for operators came a few days later when the fixed builds stopped being "upcoming" and became real upgrade targets.

What FG-IR-26-175 closed

On-prem branches: 8.0.0 through 8.0.1 go to 8.0.2 or later. 7.6.0 through 7.6.6 go to 7.6.7 or later. 7.4.0 through 7.4.8 go to 7.4.9 or later. 7.2.0 through 7.2.9 have no 7.2 fix. You leave that branch for 7.4.9 or newer. FortiMail Cloud was moved by Fortinet on October 5 to 7.6.7 or 8.0.2, so cloud tenants do not have a self-patch chore for this CVE. We are not publishing request samples. If your GUI is on the internet and you are below those builds, treat that as enough reason to act.

Some early coverage tied the practical risk to IBE and exposed management interfaces. The durable close is still the firmware move, not a temporary toggle you forget about in November. Patching stops new writes. It does not undo a write that already landed.

Mail appliances still sit on the internet

Plenty of Alberta firms and public-sector shops still run FortiMail as the MX or as a scrubbing hop in front of Microsoft 365. That box sees every inbound message and often holds quarantine, encryption, and admin trust. An unauthenticated write on the mail edge is how you lose the filter that was supposed to protect everyone else. If you outsource mail but still own an on-prem FortiMail for a legacy domain or a partner relay, you are in scope too.

Upgrade targets and follow-up

Confirm the exact build string on every FortiMail, including HA peers and any lab unit that can still route mail. Schedule the jump to a fixed release. After upgrade, review admin accounts, unexpected files under web and temp paths, and any new or odd IBE or archive-related accounts that appeared around early October. Rotate admin credentials and API tokens if the GUI was reachable from the internet while vulnerable. Keep management off the public internet going forward. That is boring advice. It still works.

Bottom line

CVE-2026-104286 is a critical, exploited FortiMail write with clear fixed builds. Cloud is handled. On-prem is on you. Get to 8.0.2, 7.6.7, or 7.4.9, or leave 7.2 entirely, then check whether someone already used the window before you closed it.