CVE-2026-104286 in Fortinet's mail gateway: no password, one HTTP request, and the attacker writes files on the system. Fortinet says it has been reported exploited. The fixed versions are "upcoming". Until they land: switch off IBE or take management off the internet. CISA set the deadline for 4 October.
- CVSS 9.8, unauthenticated, path traversal plus a NULL byte. Affected: FortiMail 7.2, 7.4, 7.6 and 8.0.
- The fixes 8.0.2, 7.6.7 and 7.4.9 are "upcoming". Workaround: IBE Service off, or the management interface away from the internet.
- Fortinet lists indicators: a new account archive234, an added /data/lib/liblog.so, a modified httpd.conf, two IP addresses. Check them before you switch anything off.
Every message to the company passes through the mail gateway before a person sees it. Now that gateway has a hole rated 9.8, someone is already using it, and the version that closes it has not shipped.
CISA's deadline is 4 October. No patch is promised by then. So the deadline is for the workaround: IBE off, or management hidden from the internet. The rest of CISA's instruction is drier still: if no mitigation is available, you stop using the product.
Read the indicators before you switch anything off. An added account archive234, a new library in /data/lib, a touched httpd.conf. If any of that is on your box, the workaround is late and the job is a different one: you isolate the machine and preserve the evidence. That is why CISA writes forensic triage.
IBE is the mail encryption feature Fortinet tells you to switch off. If you do not use it, switch it off now and stop thinking about it. If you do, choose: no IBE for a few days, or a management interface that does not face the internet. The third option, waiting for the version, is not an option.