An exploited weakness in the mail gateway
Fortinet’s October 1 advisory for CVE-2026-104286 warns that attackers are exploiting a FortiMail vulnerability that permits unauthenticated file writes through crafted HTTP or HTTPS requests. Its severity rating is critical. The advisory covers FortiMail 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8 and 7.2.0–7.2.9. At this edition’s review, the listed corrected releases for the newer branches remained marked upcoming. Customers should consult the live advisory before choosing a software target; the publication of an advisory does not mean every promised update is already available.
The vendor’s immediate options
Fortinet urges customers to disable Identity Based Encryption support. It also describes alternatives involving restriction of internet access to webmail or filtering specified requests through a web application firewall. The advisory includes indicators for investigating possible compromise. These are vendor-provided measures for the identified product, not a claim that every organization using Fortinet equipment is affected. Administrators should follow the current instructions for their installed branch and deployment.
A service decision for the business
Our assessment: an MSP supporting a small law firm, accountant or other professional-services business should treat mitigation as both a security change and a customer-service change. First establish who uses the affected feature and which communications depend on it. Document the temporary workflow before disabling functionality. A blocked business process can encourage users to improvise with personal email or unapproved file sharing, creating another problem while the original one is being contained. The response owner should explain the change in plain language and provide a supported alternative for time-sensitive messages.
Keep containment and investigation separate
A useful response record should answer three questions: which systems were exposed, what changed to reduce access, and what evidence remains to assess earlier activity. Ask the service provider to preserve relevant logs and record the time each measure took effect. Do not use a successful workaround test as proof that the system was never accessed. Conversely, a matching indicator needs investigation in context rather than an automatic declaration of data theft. Assign a named owner to revisit the vendor’s release table, schedule the applicable update and validate the affected business workflow afterward. The temporary control needs an exit plan as well as an installation ticket. Keep customers informed when the temporary arrangement changes or the maintenance window moves.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
