What Happened
Fortinet disclosed FortiMail zero-day CVE-2026-104286, rated CVSS 9.8. The Hacker News reports unauthenticated attackers write arbitrary files to the system through crafted HTTP or HTTPS requests. The cause is a path traversal flaw combined with improper handling of NULL bytes. It affects FortiMail 7.2.0 through 7.2.9, 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1.
Fortinet lists patched releases 7.4.9, 7.6.7, and 8.0.2 as forthcoming. Researchers found seven suspicious files and two attacker IP addresses on compromised systems. CISA added the flaw to its Known Exploited Vulnerabilities catalog and set an October 4 deadline for federal agencies.
Why This Matters for Canadian Organizations
FortiMail sits at the front door of email. It handles filtering and encryption for mail carrying invoices, contracts, and personal data. An attacker who writes files to the appliance owns a trusted position inside your mail flow.
Canadian provinces, school boards, hospitals, and mid-sized firms use Fortinet gear widely, and many manage it with small teams. No patch exists yet, so exposure lasts until you apply mitigations. A compromise exposing customer email is a likely breach of security safeguards under PIPEDA. Report it to the Privacy Commissioner and affected individuals when the risk of significant harm is real. The Canadian Centre for Cyber Security routinely urges owners of exploited edge devices to act on vendor guidance without waiting for a Canadian advisory.
What to Do
Disable the IBE feature, which Fortinet names as a workaround. Block internet access to the management interface and limit it to trusted private networks. Hunt for the published indicators, including 79.141.169.187 and 45.129.0.192, in firewall and web logs. Plan to move FortiMail 7.2 appliances to the 7.4 branch or later. Install the fixed releases the day they ship. Read our TechTalk archive and the October 2 daily brief for related edge device coverage.
