Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN962
_____________________________________________________________________

DATE                : 02/10/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running FortiMail versions prior to
                                8.0.2, 7.6.7, 7.4.9.
  
=====================================================================
https://fortiguard.fortinet.com/psirt/FG-IR-26-175
_____________________________________________________________________

Improper limitation of a pathname to a restricted directory


Summary

An Improper Limitation of a Pathname to a Restricted Directory
('Path Traversal') [CWE-22] and Improper Neutralization of NULL Byte
or NULL Character [CWE-158] vulnerability may allow an unauthenticated
attacker to write arbitrary files on the underlying system via crafted
HTTP or HTTPS requests.

This has been reported to be exploited in the wild, customers are urged
to apply the workaround below.


Version 	Affected 	Solution
FortiMail 8.0 	8.0.0 through 8.0.1 	Upgrade to upcoming 8.0.2 or above
FortiMail 7.6 	7.6.0 through 7.6.6 	Upgrade to upcoming 7.6.7 or above
FortiMail 7.4 	7.4.0 through 7.4.8 	Upgrade to upcoming 7.4.9 or above
FortiMail 7.2 	7.2.0 through 7.2.9 	Upgrade to branch 7.4 or above


Workaround:

    Disable the IBE feature support via the GUI
( Encryption -> IBE -> IBE Service 'off' ) or with the following CLI command:

config system encryption ibe
set status disable
end

    Alternatively: Disable access to the FortiMail management interface
from the internet or limit the access only from trusted private network

Indicators of Compromise (IoC):

Files:

* [ADDED]/data/lib/liblog.so  MD5 - 64c90a00c7fda4d5c7973ed64c25783a SHA256 - 8015f34dc84922b03688399d7f9fe7a00361789f7e420c7e2a2cdb23e75cef84 
* [MODIFIED]/bin/smit   MD5 - 5241738a3e9988404239e12243f6d35b SHA256 - 77324ac428bde86d351fc5fc06f6d64a6bfe737dfb2743df1d4c5ac2418a5b6a
* [ADDED]/data/bin/webconsole   MD5 - ae0ea6502d3fa5f0664bceb73189eb54 SHA256 - 7a6cea9f5c9e2e9994d4e3c4da73f86cf5acd05ea5d312c066c9d1dafd69ee38
* [ADDED]/data/bin/mailservice  MD5 - f90fa81a5f521d785f2b2f765e3ab897 SHA256 - 4000276a150a165d3c2537d1e19fb393c4de8333076a16655e28059cae82157b
* [MODIFIED]/data/etc/httpd.conf    MD5 - 61af1c4bce1c2eebc8ff689ca5337791 SHA256 - 703e97c64e61e41dc3aaba580d82bb2aa7b6a11b54ee6fb467ed5d5a3bffdef5
* [ADDED]/data/etc/ld.so.preload    MD5 - 8eb64f25d2a8e18e05aae058629473cf SHA256 - 8953ec7960b09f544a880b072ad4e6cfda7a8303f486251d3478dcfdfbac23b6
* [MODIFIED] /data/migadmin.tar.gz  MD5 - 49a7156a7d043cc8f9f680579db22f86 SHA256 - d6fe51c22b91776f4c961ea58bcac5917f15d560a619d7ce726d3d51795609d3

IPs:

79[.]141.169.187
45[.]129.0.192

System Event Logs:

- type=event subtype=system pri=debug user=system ui=cron msg="(root) CMD (/bin/sh -c 'O=/migadmin ...
- type=kevent subtype=admin pri=information user=admin ui=(null) action=logout status=success reason=unknown msg="User admin logged out from (null)."
- type=kevent subtype=config pri=information user=admin ui=cli module=unknown submodule=unknown msg="Added 'archive234' to 'archive account' : rotation-size[50]rotation-time[1] rotation-hour[14]destination[remote]remote-ip[79.141.169.187]remote-username[archive234]remote-password[***]remote-directory[/uploads] (user: admin, from: cli)"

Encryption Logs:

- FortiMail::IBE::DecrypterMediaIn::DecrypterMediaIn(FortiMail::MediaIn&, const FortiMail::IBE::KeyFinder&, const FortiMail::EmailAddress&, const FortiMail::Buffer&, FortiMail::IBE::DecrypterMediaIn::Version): Caught BufferException(2), BufferImpl.cpp:973, 'Invalid Base64 Encoding at pos 0. Character=0x2a'
- Internal user *@domain.tld<mailto:*@domain.tld> failed to log in.



Acknowledgement
Internally discovered and reported by Gwendal Guégniaud of Fortinet
Product Security team


Virtual Patch
No

Timeline

2026-10-01: Initial publication


IR Number              FG-IR-26-175
Published Date         Oct 1, 2026
Component              GUI
Severity               Critical
Discovered             Internal
Attack Type            Unauthenticated
Known Exploited        Yes
CVSSv3 Score           9.8
Impact                 Execute unauthorized code or commands
CVE ID 	               CVE-2026-104286
Download 	
                       CVRF
                       CSAF
                       STIX

=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================