Fortinet published advisory FG-IR-26-175 on 1 October 2026 for a flaw in FortiMail, its email security gateway, and said in the same breath that it was already being exploited. There was no fix to install. The only options Fortinet offered were a configuration change that disables a feature, or cutting the management interface off from the internet entirely. CISA added the bug to its Known Exploited Vulnerabilities catalog the same day and gave federal agencies three days to respond — not to patch, since none existed yet, but to find out whether they’d already been hit.

A path that was supposed to stay inside one folder

CVE-2026-104286, rated CVSS 9.8, combines two well-understood bug classes that are individually unremarkable and, combined, let an unauthenticated attacker write arbitrary files anywhere on the underlying system. Fortinet’s advisory and reporting by security researcher outlet watchtowr describe it as a weakness in how FortiMail’s web management interface handles file paths and null bytes inside incoming HTTP or HTTPS requests. In plain terms: a crafted request tricks FortiMail into writing a file outside the folder it was supposed to be confined to, and because the request needs no credentials at all, anyone who can reach the management interface over the network can trigger it. Fortinet’s own classification pairs CWE-22 (path traversal) with CWE-158 (improper null byte neutralization) — the null-byte component is what lets the crafted path slip past whatever sanitization was meant to stop a traversal attempt in the first place.

The vulnerable code path runs through FortiMail’s Identity-Based Encryption feature, a mechanism for encrypting mail to recipients who don’t have their own key infrastructure set up. Once an attacker can write an arbitrary file to the system, watchtowr’s analysis notes the next step is straightforward: use that write capability to plant something that executes, and from there run commands on the device itself — “full control of the mail gateway,” as the FAQ puts it, with access to stored mail, credentials, and whatever else the gateway connects to.

What attackers did once they were in

The write primitive alone doesn’t explain why CISA’s catalog entry calls for forensic triage rather than a routine patch-and-move-on. BleepingComputer’s reporting on the advisory describes attackers using the arbitrary file write to configure mail-archiving accounts that point at servers the attacker controls, then scheduling cron jobs to run on a recurring basis — a setup that looks, from inside the device, like ordinary mail administration, and functions as a standing exfiltration pipeline. That’s the detail that turns “an attacker wrote a file” into “an attacker has a durable, low-visibility channel for pulling data out of the organization’s mail flow indefinitely,” and it’s why Fortinet’s advisory and CISA’s guidance both emphasize checking for signs of prior compromise before trusting that a patch alone closes the incident.

No patch, no exploit details, a three-day federal deadline anyway

Fortinet credited its own Product Security team — specifically Gwendal Guégniaud — with finding the flaw internally, rather than crediting an external researcher or responding to an incident report. That’s notable because it means the “actively exploited” determination didn’t come from a customer calling in a breach; Fortinet found the bug and, in the course of investigating it, determined attackers were already using it in the wild. BleepingComputer’s reporting notes Fortinet’s advisory stops short of saying when the attacks began, who is behind them, or how many customers have been hit — an unusually thin disclosure for a bug already rated as exploited.

Fortinet’s guidance at disclosure was two-fold: disable Identity-Based Encryption via config system encryption ibe / set status disable, or restrict the management interface to a trusted private network rather than leaving it reachable from the internet. Fixed builds — 7.4.9, 7.6.7 and 8.0.2 — were only promised, with no release date attached, meaning every FortiMail deployment that couldn’t apply the workaround was running exposed for an indefinite window. SecurityWeek’s coverage frames this as the second time in 2026 that Fortinet has shipped a Known-Exploited advisory with mitigation-only guidance rather than a patch — a pattern that, as with Cisco’s repeated SD-WAN KEV entries this year, turns network segmentation from a best practice into the only real control an organization has.

Why the email gateway is worth this much attacker effort

FortiMail doesn’t just relay mail — it’s the inspection point that scans, filters and, with IBE enabled, encrypts an organization’s outbound and inbound email. An attacker with full control of that gateway sits in a position to read mail in transit, harvest credentials embedded in message traffic, and pivot toward whatever internal systems trust mail-gateway infrastructure by default. It’s the same calculus that made SonicWall’s SMA1000 SSRF-to-RCE chain valuable to attackers earlier this year: the product’s job is to sit at a trust boundary, which means compromising it doesn’t just expose one system — it exposes everything that boundary was supposed to protect.

The lessons that generalise

An unauthenticated file-write primitive is rarely the end goal — it’s the first step to code execution. CVE-2026-104286 by itself “only” writes files. Combined with a management interface that executes what it finds in the right location, that’s a complete remote-code-execution chain, which is exactly why CISA rated the required response as forensic triage, not just patching.

A vendor finding its own zero-day internally is good news and bad news at once. It means Fortinet’s security team is actively hunting for this class of bug rather than waiting for a researcher’s disclosure. It also means the “actively exploited” determination arrived without the usual trail — a reported incident, an IoC set from a victim — which is why Fortinet’s own advisory could say so little about who’s behind the attacks or how long they’d been running.

“Mitigation available, patch pending” is a worse position than it sounds. A workaround that disables a feature (IBE) is a real control, but it’s also a functionality cut an organization has to choose to accept before knowing how long the gap will last. Teams that waited for a “come back once it’s patched” signal were, by definition, still exposed.

Management interfaces for security products belong on a network only their administrators can reach. Every mitigating step in this advisory reduces to the same underlying fix: don’t let the internet talk to the interface that controls the appliance. That’s true regardless of which CVE is current, and it’s the control that holds even when the next zero-day in this product line hasn’t been found yet.

Tech-Bee is an independent technology publication. This piece is drawn from Fortinet’s own PSIRT advisory FG-IR-26-175, CISA’s Known Exploited Vulnerabilities catalog entry, and reporting by BleepingComputer and SecurityWeek.