Unauthenticated path traversal in FortiMail IBE webmail allows arbitrary file write and code execution (CVE-2026-104286)
Fortinet confirmed in-the-wild exploitation and CISA added the flaw to KEV on 2026-10-01 while fixed builds are still listed as upcoming, so any FortiMail with IBE and internet-facing webmail left in its current configuration is exposed to a known, unauthenticated code-execution path.
A path traversal combined with NULL-byte handling in FortiMail's IBE (Identity-Based Encryption) web endpoint lets an unauthenticated attacker write arbitrary files on the appliance via crafted HTTP/HTTPS POST requests to /ibe, which Fortinet rates as leading to execution of unauthorized code or commands. Fortinet's advisory supplies attacker IPs and log artefacts showing cron-based command execution and creation of a rogue remote archive account for exfiltration.
Affected: FortiMail 8.0.0 through 8.0.1; FortiMail 7.6.0 through 7.6.6; FortiMail 7.4.0 through 7.4.8; FortiMail 7.2.0 through 7.2.9
How to Test
Check the FortiMail firmware version against the affected ranges (8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8, all 7.2.x) and whether the IBE service is enabled (Encryption -> IBE). Review System Event Logs for the cron entry `type=event subtype=system pri=debug user=system ui=cron msg="(root) CMD (/bin/sh -c 'O=/migadmin ...`, for `user=admin ui=(null) ... msg="User admin logged out from (null)."`, and for a config log adding an archive account such as `Added 'archive234' to 'archive account' ... remote-ip[79.141.169.187] ... remote-directory[/uploads]`. Check web/WAF logs for POST requests to /ibe containing `../`, and firewall/netflow for traffic to 79.141.169.187 or 45.129.0.192. Treat any match as a compromise and rotate admin credentials.
How to Mitigate
Fixed releases are FortiMail 8.0.2, 7.6.7 and 7.4.9, which Fortinet lists as upcoming; 7.2 users must migrate to the 7.4 branch or later. Until the fixed build is installed, apply Fortinet's workaround: disable IBE in the GUI (Encryption -> IBE -> IBE Service 'off') or via CLI `config system encryption ibe` / `set status disable` / `end`. Alternatively, block internet access to the FortiMail webmail interface (allow only trusted private networks), or if a WAF fronts FortiMail, block POST requests to /ibe that contain '../'.