FortiMail under zero-day attack
Is your corporate mail server being attacked right now without your knowledge?
Fortinet confirms active exploitation of a critical zero-day in FortiMail.
The flaw, catalogued as CVE-2026-104286 with a CVSS score of 9.8, allows any unauthenticated attacker to write arbitrary files to the system through crafted HTTP requests.
Patches for versions 7.4, 7.6, and 8.0 do not yet exist, leaving thousands of organizations exposed while attacks are already taking place.
Attackers are already inside some compromised systems.
The flaw combines two technical weaknesses: a path traversal vulnerability and improper neutralization of NULL characters. Together, they allow an attacker with no authentication whatsoever to send specially crafted HTTP or HTTPS requests to drop malicious files directly onto the server’s operating system. No password needed, no account needed, nothing more than access to the FortiMail management interface.
Fortinet has already published and confirmed indicators of compromise.
Among the evidence Fortinet has shared is an archive account named archive234 configured from the command line, pointing to a remote server at IP 79.141.169.187. This suggests the attacker programmed the system to send archived data outbound. Suspicious scheduled tasks, IBE decryption errors, and multiple failed access attempts indicative of prior reconnaissance activity have also been identified.
CISA requires federal agencies to mitigate this before October 4th.
Fortinet is coordinating its response with CISA and other government bodies, but the reality is that system administrators cannot wait for the official patch. Affected versions range from FortiMail 7.2 to 8.0.1, and the corrective updates are still listed as upcoming, with no exact release date.
This pattern is not unique to FortiMail.
Firewalls, mail gateways, and management platforms have been the preferred target of threat actors seeking frictionless entry points for months.
A management interface exposed to the internet turns any critical flaw into a direct highway for attackers.
CISA’s KEV catalog has accumulated dozens of actively exploited vulnerabilities in network security products in 2025.
Exposed management is the Achilles’ heel.
While patches are on the way, Fortinet offers two options: disable the IBE feature using specific commands, or cut off access to the management interface from the internet. Neither is perfect, but both reduce the attack surface.
The real problem goes beyond the patch.
Corporate mail gateways like FortiMail are critical infrastructure: they manage internal communications, filter incoming threats, and in many cases archive sensitive messages. An attacker who compromises this type of system not only gains a foothold in the network, but potential access to confidential data, credentials, and historical communications that can be leveraged for much deeper lateral movement within the organization.
The attacker configured the system to silently exfiltrate data.
The indicators of compromise published by Fortinet reveal that the attacker reconfigured the mail server to send copies of archived data to an external server under their control. This turns the incident into a potential data breach, not merely a one-time intrusion that can be contained.
With no patch available, manual mitigation is the only defense right now.
If you administer FortiMail on affected versions, you have two options: run the IBE deactivation commands from Fortinet’s official advisory, or isolate the management interface from any external access. Waiting for the patch is not a valid option when attacks are already occurring.
Review your logs: attackers leave a trail.
Fortinet has published concrete examples of log entries indicating compromise: unrecognized archive accounts, suspicious cron jobs, and Base64 decoding errors in the IBE module. Reviewing those records right now can make the difference between detecting an intrusion in time or discovering it weeks later with far more damage done.
Update as soon as patches become available.
Fortinet has not disclosed how many systems are already compromised or who is behind the attacks. Has your organization reviewed its FortiMail logs today?
Act right now
- ✓Disable external access to the FortiMail management interface.
- ✓Apply the IBE workaround following Fortinet’s official advisory.
- ✓Review your logs looking for archive234 and the IPs published as IOCs.
Have you already checked whether your FortiMail is among the affected systems?
Security is not improvised, it is audited. At Nacata Security we detect vulnerabilities and protect your company, because a single flaw can cost you everything you have built.
Related articles
Zimbra caught in Russian espionage
Do you know if your corporate email is being emptied right now by Russian spies?
The CISO loses total control
Do you think there is someone in complete command of your bank’s cybersecurity?
Keio derailed by ransomware
Can you imagine a cyberattack cutting off payment at your Tokyo hotel?
macOS puts the brakes on AI
Did you know an app can read your emails without you ever finding out?
eMAPT Conquers Mobile
eMAPT, the INE certification that validates professional penetration testing on Android and iOS mobile applications.
Nacata Security, reach out to us anytime
We are Nacata Security, get to know us
web: nacata.io
email: info@nacata.io
Phone: 919930793
LinkedIn: Nacata Security
Risks and attacks happening right now: vulnerabilities being actively exploited, official alerts from cybersecurity agencies, ongoing phishing or malware campaigns.
Information meant to help you act and protect yourself before the problem reaches you.
RATING
9.6
Who are we?
At Nacata Security we are an offensive cybersecurity company specialized in audits and penetration testing.
We detect, assess and help mitigate the vulnerabilities of your systems, networks and applications before a real attacker exploits them, offering 360º defense tailored to each client.
We’d be glad to get in touch with you for whatever you need.