Fortinet FortiMail Flaw Enables Unauthenticated Arbitrary File Write

En bref

• CVE-2026-104286 affects Fortinet FortiMail.
• Unauthenticated attackers can combine path traversal and a NULL byte issue for arbitrary file write.
• Risk is medium, but internet-facing appliances raise concern.
• Apply mitigations, follow BOD 26-04, assess exposure, and discontinue if no fix exists.

Fortinet has disclosed a security weakness in FortiMail, tracked as CVE-2026-104286. According to the available facts, an unauthenticated attacker can abuse a path traversal condition alongside a NULL byte flaw to achieve arbitrary file write on affected systems. That combination matters because no credentials are required, lowering the barrier for exploitation and increasing the chance that exposed appliances become targets.

FortiMail is a secure email gateway, so organizations that run it—including school districts and government agencies—may rely on it for mail filtering, routing, and protection. If an adversary can write files without logging in, they could potentially alter configuration, plant malicious content, or disrupt mail flow, depending on how the product is deployed and what permissions the service holds. The severity is currently assessed as medium, but exposure and configuration can change real-world risk.

Defenders should treat internet-facing FortiMail instances as the highest priority. The recommended actions are to apply vendor mitigations, follow BOD 26-04 requirements, and evaluate whether each appliance is reachable from the public internet. If no fix is available, the guidance points toward discontinuing use rather than leaving an unpatched, exposed system in production.

Because the flaw involves unauthenticated exploitation, monitoring for unusual file writes, unexpected configuration changes, and anomalous mail gateway behavior is important. Administrators should also verify that management interfaces are not unnecessarily exposed and that compensating controls are in place while remediation is pending. The situation remains developing; watch for updated Fortinet guidance, patch availability, and any signs of active scanning or exploitation.

À faire maintenant

1. Inventory all FortiMail deployments and identify which instances are reachable from the internet; prioritize those first.
2. Apply Fortinet-supplied mitigations or patches as soon as they are available, and document the change.
3. Follow BOD 26-04 reporting and remediation timelines for known exploited or high-risk vulnerabilities.
4. If no fix exists, isolate or discontinue the affected FortiMail service rather than leaving it exposed.
5. Restrict management access to trusted networks, enforce MFA, and review firewall rules for unnecessary exposure.
6. Monitor logs for unexpected file writes, path traversal attempts, NULL byte patterns, and configuration changes.
7. Validate backups and recovery plans for mail services in case remediation requires downtime.

Source originale

CISA Known Exploited Vulnerabilities