FortiMail CVE-2026-104286: IBE Path-Traversal Zero-Day Exploited to Backdoor Email Gateways

Rudra Verma, Senior Security Architect & Researcher · 2026-10-17

On October 1, 2026 Fortinet disclosed CVE-2026-104286, an unauthenticated path-traversal flaw (CWE-22) in the FortiMail secure email gateway, and confirmed it is being exploited in the wild as a zero-day. CISA added it to the Known Exploited Vulnerabilities catalog the same day, giving U.S. federal agencies until October 4 to patch or mitigate.

The bug combines path traversal with NULL-byte handling in the Identity-Based Encryption (IBE) feature to let an unauthenticated attacker write arbitrary files via crafted HTTP/HTTPS requests. Observed intrusions use that primitive to drop a shared object and an /data/etc/ld.so.preload entry — a classic Linux preload rootkit — plus backdoor binaries and a rogue archive234 account. No threat actor has been attributed.

If you run FortiMail with a reachable admin/webmail interface, treat any unpatched appliance as a compromise candidate. This brief covers the affected versions, the exploit mechanics, the full IOC set, DFIR triage, KQL/SPL detections, ATT&CK mapping and the Fortinet workarounds.

◈ Table of Contents

01 Background & Affected Products 02 Disclosure & Exploitation Timeline 03 Initial Access — The IBE Primitive 04 Technical Deep Dive — Path Traversal to Rootkit 05 Post-Exploitation & Persistence 06 Attacker Infrastructure 07 DFIR Investigation Steps 08 Indicators of Compromise 09 Detection & Hunt Queries 10 MITRE ATT&CK Mapping 11 Mitigation & Hardening 12 Sources & References

🛰️

01 · Background & Affected Products

PHASE 01 / 12

FortiMail is Fortinet's secure email gateway — an anti-spam, anti-malware, DLP and email-encryption appliance that sits in front of corporate mail flow. It runs a hardened Linux image with a web-based administration console (migadmin) and an end-user webmail portal. Because it is an internet-facing edge appliance that terminates mail, a pre-authentication flaw in its web stack is a direct path to the inside of an organisation's messaging infrastructure.

CVE-2026-104286 is a relative path traversal (CWE-22) in the IBE component, compounded by improper NULL-byte handling. Fortinet rates it CVSS 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and temporal metrics E:P/RL:O/RC:C — network-reachable, low complexity, no privileges, no user interaction. The discovery is credited to Gwendal Guégniaud of the Fortinet Product Security team, meaning it was found internally rather than reported by an external researcher.

Count of vulnerable patch levels per FortiMail branch

Vulnerable patch levels per FortiMail branch — every supported branch is affected up to the fixed release.

Affected & fixed versions

Branch	Affected range	Fixed in	Action
FortiMail 8.0	8.0.0 – 8.0.1	8.0.2 rec	Upgrade to 8.0.2+
FortiMail 7.6	7.6.0 – 7.6.6	7.6.7	Upgrade to 7.6.7+
FortiMail 7.4	7.4.0 – 7.4.8	7.4.9	Upgrade to 7.4.9+
FortiMail 7.2	7.2.0 – 7.2.9	— EOL path	Migrate to 7.4.9+ branch

At initial disclosure the fixed builds were still rolling out. If a target build is not yet downloadable for your platform, apply the IBE workaround in Phase 11 immediately rather than waiting for the image. Exploitation is already happening.

Attribute	Value
CVE	CVE-2026-104286
CVSS v3.1	9.8 CRITICAL — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE	CWE-22 (Path Traversal) + NULL-byte handling
Advisory	Fortinet PSIRT FG-IR-26-175
Published / KEV	2026-10-01
CISA remediation due	2026-10-04
Attribution	Unattributed (no actor named by Fortinet or CISA)

🕑

02 · Disclosure & Exploitation Timeline

PHASE 02 / 12

What happened, in order

Timeline

1Pre-disclosure: Attackers exploit the IBE path-traversal as a zero-day. Fortinet did not state when or where the first intrusions were observed, nor how many systems were affected.
2Internal discovery: Fortinet's own Product Security team (Gwendal Guégniaud) identifies the flaw, confirming an in-house find rather than an external report.
3Oct 1, 2026: Fortinet publishes advisory FG-IR-26-175 with IOCs and workarounds and flags confirmed active exploitation.
4Oct 1, 2026: CISA adds CVE-2026-104286 to the KEV catalog and sets the Binding Operational Directive 22-01 remediation date.
5Oct 4, 2026: CISA deadline for federal agencies to patch, apply the workaround, or discontinue use — and to run forensic triage on exposed appliances.

Internal-discovery advisories that ship with IOCs on day one almost always mean the vendor caught the exploitation through incident response, not fuzzing. Treat the published IOC list as evidence from a real intrusion, not a theoretical POC.

🚪

03 · Initial Access — The IBE Primitive

PHASE 03 / 12

The entry point is FortiMail's Identity-Based Encryption (IBE) feature. IBE lets external recipients without an S/MIME or PGP key read encrypted mail through a web pull portal — the appliance stores the encrypted message and the recipient authenticates to a web endpoint under /ibe to retrieve it. That endpoint is reachable pre-authentication by design, because the whole point is to serve recipients who have no account. Fortinet's own workaround — disabling IBE and blocking POST requests to /ibe that contain ../ — pinpoints this path as the exploited surface.

Why IBE is an attractive target

Access

IBE handlers accept attacker-controlled file and path parameters while running in the appliance's privileged web context. A traversal there is not a read of a config file — it is an arbitrary write primitive against a root-owned filesystem, which is the strongest class of edge-appliance bug.

1Pre-auth reachability: the IBE portal is intended for unauthenticated external recipients, so no credential is needed to reach the vulnerable handler.
2Write, not read: the flaw yields arbitrary file creation/overwrite, so the attacker plants code rather than merely leaking data.
3Privileged context: the web process writes into root-owned paths such as /data/lib, /data/bin and /data/etc.

Many FortiMail deployments expose the admin console and webmail to the internet for remote administration. If /ibe is reachable from untrusted networks, this is a one-request pre-auth compromise with no user interaction.

🧬

04 · Technical Deep Dive — Path Traversal to Preload Rootkit

PHASE 04 / 12

This phase is where the bug becomes a rootkit. Two primitives combine: a relative path traversal that escapes the IBE storage directory, and NULL-byte / improper character handling that lets the attacker truncate or sanitise-bypass the server-side filename validation. Together they turn a constrained "store this encrypted blob" operation into "write these exact bytes to this exact absolute path."

Step 1 — Escape the storage directory

Traversal

The IBE handler expects a filename relative to a message store. By injecting ../../ sequences, the attacker walks up out of the store and selects an arbitrary destination on the appliance filesystem. A NULL byte (or equivalent terminator) truncates any extension the server tries to append, so a path like payload%00 lands as payload rather than payload.enc.

Conceptual request shape (defensive illustration — do not weaponise)

# Unauthenticated POST to the IBE endpoint, traversal in a path parameter POST /ibe/... # handler that accepts a recipient/file path target = "../../../../data/etc/ld.so.preload" # escape store, absolute dest terminator = NULL byte # defeat extension/suffix append body = "/data/lib/liblog.so" # content written verbatim

The request shape above is intentionally abstract. Fortinet has not published a full POC and neither do we — the point is to understand the write primitive for detection and triage, not to reproduce it.

Step 2 — Plant the shared object

Payload

The attacker writes a malicious shared library to /data/lib/liblog.so. The /data partition is the persistent, writable volume on a FortiMail appliance — anything placed there survives reboots and most firmware operations, unlike the read-only system image. The filename deliberately mimics a logging library so it blends into a casual directory listing.

1Persistent volume: /data is writable and survives reboot, making it the natural home for implants.
2Innocuous name: liblog.so reads as a stock logging library to anyone skimming ls output.
3Root ownership: files land root-owned because the web process runs privileged.

Step 3 — Arm the dynamic linker (ld.so.preload)

Rootkit

The attacker then writes /data/etc/ld.so.preload containing the path to liblog.so. On Linux, the dynamic linker (ld.so) reads ld.so.preload at process start and force-loads every library listed into every dynamically-linked process, before the program's own libraries. This is the textbook LD preload rootkit: the malicious .so gets injected system-wide and can hook libc functions — think open, readdir, write, authentication and logging calls — to hide files, hide processes, suppress log lines (hence the "liblog" name) and backdoor authentication.

The persistence mechanism in one line

$ cat /data/etc/ld.so.preload # A single line is enough to inject the implant into every new process: /data/lib/liblog.so

A non-empty ld.so.preload on an appliance you never configured for library preloading is, by itself, a high-confidence compromise indicator. There is almost no legitimate reason for a vendor-maintained FortiMail image to carry one.

Step 4 — Drop operator backdoors and tamper with the system

Impact

Beyond the preload rootkit, intrusions write standalone backdoor binaries — /data/bin/webconsole and /data/bin/mailservice — and modify legitimate system components: the FortiMail CLI shell /bin/smit, the web server config /data/etc/httpd.conf, and the admin GUI archive /data/migadmin.tar.gz. Overwriting migadmin.tar.gz is how a web interface backdoor gets planted: it is the packaged admin web root, so tampered contents are served straight from the management console.

Artifact	Operation	Purpose (inferred)
/data/lib/liblog.so	Added	Preloaded rootkit library (libc hooking)
/data/etc/ld.so.preload	Added	Forces liblog.so into every process
/data/bin/webconsole	Added	Backdoor binary
/data/bin/mailservice	Added	Backdoor binary (masquerades as mail daemon)
/bin/smit	Modified	FortiMail CLI shell tampering
/data/etc/httpd.conf	Modified	Web server config change (expose backdoor route)
/data/migadmin.tar.gz	Modified	Admin GUI web root — likely webshell implant

Unauthenticated IBE write → shared object → ld.so.preload rootkit → backdoors + rogue account.

🧷

05 · Post-Exploitation & Persistence

PHASE 05 / 12

The archive234 account

Persistence

Fortinet's IOCs include a rogue account named archive234 that is configured to store archived mail on 79.141.169.187 — one of the two attacker IPs. This is both a persistence mechanism and a data-exfiltration channel: FortiMail's legitimate mail-archiving function is repurposed to stream copies of messages to attacker-controlled infrastructure under the guise of a normal archive policy.

1Looks legitimate: it uses a supported FortiMail feature (remote mail archiving), so it will not trip malware alarms.
2Survives patching: a configured account and archive target persists across a firmware upgrade unless explicitly removed.
3Exfil at scale: every message flowing through the gateway can be copied off-box.

Layered persistence = multi-stage cleanup

Resilience

The intrusion stacks at least three independent footholds: the ld.so.preload rootkit, standalone backdoor binaries in /data/bin, and the archive account in configuration. Removing one does not remove the others. A responder who deletes liblog.so but leaves archive234 and webconsole in place has not evicted the attacker.

Persistence footholds to enumerate

Dynamic-linker preload: /data/etc/ld.so.preload + /data/lib/liblog.so
Backdoor binaries: /data/bin/webconsole, /data/bin/mailservice
Config persistence: archive234 account + remote archive target
Tampered components: /bin/smit, /data/etc/httpd.conf, migadmin.tar.gz

📡

06 · Attacker Infrastructure

PHASE 06 / 12

Fortinet's advisory lists two attacker IP addresses. One, 79.141.169.187, doubles as the destination for the archive234 remote mail archive, confirming it as an exfiltration endpoint rather than just a scanner. Hunt these against firewall, proxy and NetFlow telemetry across the full retention window — exploitation predates the October 1 disclosure, so matches before that date are still in scope.

Indicator	Type	Role
79.141.169[.]187	IPv4	C2 / remote mail-archive exfil target (archive234)
45.129.0[.]192	IPv4	Attacker infrastructure (exploitation source)

Pivot both IPs in Censys/Shodan and your passive DNS. Because one IP is wired into a mail-archive config, look for SMTP/IMAP-style egress to it from the appliance management interface — not just HTTP. That traffic pattern is abnormal for a mail gateway talking to an unknown host.

🔎

Fortinet PSIRT FG-IR-26-175 — official IOC list

Authoritative source for IPs, file paths and log signatures

OPEN ↗

🧰

07 · DFIR Investigation Steps

PHASE 07 / 12

Triage a FortiMail appliance for compromise

DFIR

Run these checks in order on any appliance in the affected version range. Because the attacker tampers with the CLI (smit) and may have a log-hooking rootkit loaded, prefer out-of-band evidence (firewall/syslog collected off-box) over trusting the appliance's own output where possible.

1Check for the preload file first: any content in /data/etc/ld.so.preload is a near-certain compromise. Inspect it before anything else, since the rootkit it loads can lie to subsequent commands.
2Hash the named artifacts: compute SHA-256 of liblog.so, webconsole, mailservice and compare against a known-good image of the same build.
3Diff system components: compare /bin/smit, /data/etc/httpd.conf and migadmin.tar.gz against vendor baselines for modification.
4Audit accounts and archive policy: look for archive234 or any unrecognised account and any remote archive target pointing at an unknown IP.
5Pull egress logs off-box: query the firewall for any connection to 79.141.169.187 or 45.129.0.192 from the appliance, across full retention.
6Hunt the web logs: search for POST requests to /ibe containing ../ or encoded traversal / NULL sequences.

Do not treat a reboot or a firmware upgrade as remediation. The /data implants and the archive account persist across both. A compromised appliance should be rebuilt from a clean image and have all secrets (admin passwords, API keys, certificates, LDAP binds) rotated.

🎯

08 · Indicators of Compromise

PHASE 08 / 12

Network IOCs

Value	Type	Context
79.141.169[.]187	IPv4	C2 + archive234 exfil target
45.129.0[.]192	IPv4	Exploitation source infrastructure

Host IOCs — files added

Path	Note
/data/lib/liblog.so	Preloaded rootkit library
/data/etc/ld.so.preload	Injects liblog.so into all processes
/data/bin/webconsole	Backdoor binary
/data/bin/mailservice	Backdoor binary

Host IOCs — files modified

Path	Note
/bin/smit	FortiMail CLI shell tampered
/data/etc/httpd.conf	Web server configuration altered
/data/migadmin.tar.gz	Admin GUI web root archive altered

Account / log IOCs

Indicator	Note
archive234	Rogue account; archives mail to 79.141.169.187
archive account creation events	Unexpected archive-account add in admin logs
IBE decryption errors	Anomalous decryption-error log lines around the exploit window

Hashes are not published in the advisory. Do not fabricate SHA-256 values to "complete" an IOC feed — validate implants by comparing to a known-good image of the exact build, and alert on the file paths and the ld.so.preload existence instead.

🔭

09 · Detection & Hunt Queries

PHASE 09 / 12

FortiMail forwards syslog to a SIEM; firewalls log appliance egress. The queries below assume FortiMail/FortiGate logs are ingested into Microsoft Sentinel (CommonSecurityLog / Syslog) and Splunk. Every query has a one-line purpose.

KQL — egress to attacker IPs from the FortiMail appliance

// Finds any connection to the two advisory IOC IPs CommonSecurityLog | where DestinationIP in ("79.141.169.187", "45.129.0.192") | project TimeGenerated, DeviceName, SourceIP, DestinationIP, DestinationPort, Activity | sort by TimeGenerated asc

SPL — egress to attacker IPs from the FortiMail appliance

# Finds any connection to the two advisory IOC IPs index=network (dest_ip="79.141.169.187" OR dest_ip="45.129.0.192") | stats count min(_time) as first max(_time) as last by src_ip, dest_ip, dest_port | convert ctime(first) ctime(last)

KQL — IBE path-traversal attempts in web logs

// Finds POST requests to /ibe carrying traversal or NULL-byte sequences CommonSecurityLog | where RequestURL has "/ibe" | where RequestMethod == "POST" | where RequestURL has_any ("../", "..%2f", "%00", "%2e%2e") | project TimeGenerated, SourceIP, RequestMethod, RequestURL, DeviceName

SPL — IBE path-traversal attempts in web logs

# Finds POST requests to /ibe carrying traversal or NULL-byte sequences index=proxy uri_path="*/ibe*" http_method=POST | regex _raw="(\.\.%2f|\.\./|%00|%2e%2e)" | table _time src_ip http_method uri_path status

KQL — rogue archive account creation on FortiMail

// Finds admin/config events adding an archive account (e.g. archive234) Syslog | where ProcessName has_any ("miglogd", "admin", "httpd") | where SyslogMessage has_any ("archive234", "archive account", "add archive") | project TimeGenerated, HostName, ProcessName, SyslogMessage

SPL — rogue archive account creation on FortiMail

# Finds admin/config events adding an archive account (e.g. archive234) index=fortimail ("archive234" OR "archive account" OR "add archive") | table _time host user action object

Linux check — the single highest-confidence host detection

# On an appliance you can safely inspect: ld.so.preload should be empty/absent $ test -s /data/etc/ld.so.preload && echo "ALERT: ld.so.preload is non-empty" $ ls -la /data/lib/liblog.so /data/bin/webconsole /data/bin/mailservice # should not exist

Sigma-style logic (portable)

title: FortiMail IBE Path Traversal Exploitation (CVE-2026-104286) logsource: { category: webserver } detection: sel_uri: { c-uri|contains: '/ibe' } sel_meth: { cs-method: 'POST' } sel_trav: { c-uri|contains: ['../', '..%2f', '%00'] } condition: sel_uri and sel_meth and sel_trav level: high

If the appliance may already be rootkitted, its local ls/cat output can be hooked by liblog.so and lie to you. Corroborate host checks with off-box evidence: SIEM web logs for the /ibe traversal, and firewall logs for the two C2 IPs.

🗺️

10 · MITRE ATT&CK Mapping

PHASE 10 / 12

Tactic	Technique	ID	How it shows up here
Initial Access	Exploit Public-Facing Application	T1190	Unauth path traversal in IBE endpoint
Execution	Command & Scripting Interpreter	T1059	Unauthorized code/commands via written files
Persistence	Hijack Execution Flow: Dynamic Linker Hijacking	T1574.006	ld.so.preload loads liblog.so system-wide
Persistence	Server Software Component: Web Shell	T1505.003	Tampered migadmin.tar.gz admin web root
Persistence	Create Account: Local Account	T1136.001	Rogue archive234 account
Defense Evasion	Rootkit	T1014	Preloaded libc-hooking shared object
Defense Evasion	Impair Defenses: Indicator Blocking	T1562.006	liblog.so hooks/suppresses logging
Defense Evasion	Masquerading	T1036	liblog.so / mailservice mimic legitimate components
Collection	Email Collection	T1114	Archive policy copies mail off-box
Exfiltration	Exfil Over C2 Channel	T1041	Mail archived to 79.141.169.187

🛡️

11 · Mitigation & Hardening

PHASE 11 / 12

Patch — the only full fix

Remediate

Upgrade to a fixed build for your branch: 8.0.2+, 7.6.7+, or 7.4.9+. FortiMail 7.2.x has no in-branch fix — migrate to 7.4.9 or later. Patching a clean appliance closes the hole; patching an already-compromised appliance does not remove the /data implants or the archive account.

Workarounds until patched

Mitigate

Apply these immediately on any appliance you cannot patch this hour. They directly target the exploited IBE surface.

1Disable the IBE feature via the GUI or CLI if your deployment does not require it — this removes the vulnerable endpoint.
2Restrict webmail / admin access to trusted management networks only; never expose the console to the internet.
3WAF rule: block POST requests to /ibe that contain ../ (and encoded variants / NULL bytes).

Example upstream WAF / reverse-proxy guard (illustrative)

# Reject traversal + null bytes on the IBE path before it reaches FortiMail location ~* ^/ibe { if ($request_method = POST) { set $flag P; } if ($request_uri ~* "(\.\./|\.\.%2f|%00)") { set $flag "${flag}T"; } if ($flag = PT) { return 403; } }

If you find any IOC — assume full compromise

Rebuild

An appliance with ld.so.preload content, any dropped binary, or the archive234 account should be isolated and rebuilt from a verified-clean image, not cleaned in place. A libc-hooking rootkit can hide its own files from the tools you would use to confirm cleanup.

Eradication complete when

Appliance rebuilt from a verified-clean FortiMail image on a fixed build
ld.so.preload absent/empty; liblog.so, webconsole, mailservice gone
archive234 and any unknown archive target removed from config
All appliance secrets rotated: admin creds, API keys, certs, LDAP/SMTP binds
IBE disabled or access-restricted; WAF guard confirmed blocking traversal
No egress to 79.141.169.187 / 45.129.0.192 in current firewall logs

Why edge-appliance zero-days keep landing

🌐

Always exposed

Mail gateways must face the internet, so a pre-auth flaw is reachable by anyone with a network path — no phishing required.

👁️

Low visibility

EDR rarely runs on appliances. Defenders depend on vendor IOCs and off-box logs, which is exactly where a log-hooking rootkit hurts most.

📬

High-value position

A gateway sees all mail. Repurposing its archive feature turns compromise straight into mass email collection.

♻️

Patch ≠ clean

Persistent /data volumes mean firmware upgrades leave implants behind. Recovery means rebuild plus secret rotation.

📚

12 · Sources & References

PHASE 12 / 12

Fortinet PSIRT — FG-IR-26-175: FortiMail path traversal (CVE-2026-104286) NVD — CVE-2026-104286 record (CVSS 9.8, CWE-22) CISA Known Exploited Vulnerabilities Catalog — CVE-2026-104286 (added 2026-10-01) BleepingComputer — Fortinet warns of critical FortiMail flaw exploited in zero-day attacks The Hacker News — Critical FortiMail zero-day flaw exploited in attacks Help Net Security — Critical FortiMail zero-day exploited in the wild (CVE-2026-104286)

◈ Check your edge before an attacker does

Paste the FortiMail IOCs — 79.141.169.187, 45.129.0.192, liblog.so, archive234 — into the CyberHawk IOC Scanner to sweep your logs, and follow the incident-response SOPs for edge-appliance compromise. Track active-exploitation CVEs as they break on the CyberHawk Threat Intel feed.

◈ Stay Connected

Follow CyberHawk Threat Intel for threat intelligence, deployment guides and hands-on SOC tooling content.

🌐 Website ▶️ YouTube ▶️ YouTube (2) 𝕏 Twitter / X ♪ TikTok ✈️ Telegram

🔍 IOC Scanner 🛠️ Live Tools 📚 Courses 🚨 Threat Intel 📝 Blog 📋 SOPs

"They can't exploit you if you are the Exploit."