Introduction
As of October 1, 2026, any organization running an unpatched FortiMail instance is leaving a door wide open to the internet. That day, Fortinet published advisory FG-IR-26-175 disclosing an actively exploited vulnerability — and CISA simultaneously added CVE-2026-104286 to its Known Exploited Vulnerabilities catalog. U.S. federal agencies had until October 4 to patch or mitigate: a 72-hour window.
What "Arbitrary File Write" Actually Means in Practice
The official description — "an unauthenticated attacker can write arbitrary files to the underlying system" — understates the real-world impact. The vulnerability chains two weaknesses: an improperly restricted file path (path traversal, CWE-22) and faulty NULL character neutralization (CWE-158). A single crafted HTTP or HTTPS request, with no valid credentials whatsoever, is enough to trigger a write. CVSS score: 9.8 out of 10.
FortiMail is a secure email gateway deployed to inspect and filter all inbound and outbound business email. Its position at the network edge — often directly internet-facing to handle inbound SMTP traffic — makes it a prime target for attackers seeking a quiet foothold deep inside enterprise infrastructure.
Indicators That Point to a Sophisticated Threat Actor
The indicators of compromise Fortinet published reveal the true scope of documented attacks. Among the files reported as modified or newly created: shared libraries, web server configuration, service binaries — and, most critically, the ld.so.preload file.
That last one deserves a closer look. It is a Linux dynamic loader configuration file that forces a library to be injected into every process launched on the machine. An attacker who gains write access to it effectively achieves system-level persistence: their code runs inside every process, survives service restarts, and can intercept or manipulate any system call. This is not a stealthy intrusion — it is the installation of a functional rootkit on the appliance tasked with filtering your email.
Two IP addresses have been linked to active exploitation. Their presence in connection logs should trigger an immediate incident response.
Affected Versions and Available Patches
The impacted branches span a broad release window:
- FortiMail 8.0.0 through 8.0.1 → upgrade to 8.0.2 or later
- FortiMail 7.6.0 through 7.6.6 → upgrade to 7.6.7 or later
- FortiMail 7.4.0 through 7.4.8 → upgrade to 7.4.9 or later
- FortiMail 7.2.0 through 7.2.9 → migrate to the 7.4 branch at minimum
For teams unable to patch immediately, Fortinet offers two interim mitigations: disabling the IBE (Identity-Based Encryption) feature via the CLI, and restricting access to the management interface to trusted private networks only.
The Question That Must Come Before Everything Else
Before initiating the update process, one question takes priority: were we exposed, and for how long? Applying the patch does not close the incident for any organization that had its management interface reachable from the internet.
Forensic analysis of potentially affected appliances — connection logs, file system integrity checks, verification of libraries loaded in memory — is a prerequisite for a complete response. A patched but unexamined device may still be hosting a silent implant, invisible at first glance. That is precisely what the level of sophistication observed in this campaign suggests: attackers who are not merely after initial access, but after persistence.