Every message to the company passes through the mail gateway before a person sees it. Now that gateway has a hole rated 9.8, someone is already using it, and the version that closes it has not shipped.
Fact
The facts: on 1 October 2026 Fortinet published advisory FG-IR-26-175 for CVE-2026-104286 in FortiMail: critical, CVSS 9.8, unauthenticated. A path traversal (CWE-22) and improper neutralisation of a NULL byte (CWE-158) may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. Fortinet writes that this has been reported to be exploited in the wild and urges customers to apply the workaround. Affected: FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8 and 7.2.0 through 7.2.9. The fixed versions 8.0.2, 7.6.7 and 7.4.9 are marked as upcoming; for 7.2 the advice is to migrate to 7.4. Workaround: disable IBE (Encryption, IBE, IBE Service off) or disable access to the management interface from the internet. Indicators of compromise are given: added /data/lib/liblog.so, /data/bin/webconsole and /data/bin/mailservice, modified /bin/smit and httpd.conf, an added ld.so.preload, the IP addresses 79.141.169.187 and 45.129.0.192, and an added account archive234. It was found internally by Gwendal Guégniaud of the Fortinet Product Security team. The same day CISA added it to the KEV catalogue with a due date of 4 October 2026 and a forensic triage requirement; use in ransomware is listed as unknown.
CISA's deadline is 4 October. No patch is promised by then. So the deadline is for the workaround: IBE off, or management hidden from the internet. The rest of CISA's instruction is drier still: if no mitigation is available, you stop using the product.
Read the indicators before you switch anything off. An added account archive234, a new library in /data/lib, a touched httpd.conf. If any of that is on your box, the workaround is late and the job is a different one: you isolate the machine and preserve the evidence. That is why CISA writes forensic triage.
The patch is upcoming. The attacker is not.
IBE is the mail encryption feature Fortinet tells you to switch off. If you do not use it, switch it off now and stop thinking about it. If you do, choose: no IBE for a few days, or a management interface that does not face the internet. The third option, waiting for the version, is not an option.
Sources
Fortinet PSIRT - FG-IR-26-175, Improper limitation of a pathname to a restricted directory, 01.10.2026CISA - Known Exploited Vulnerabilities Catalog, 01.10.2026The visual is generated code-art, no third-party images.