FortiMail Under Attack: Detecting CVE-2026-104286 with QRadar and CrowdStrike

An email gateway is a sensitive place to lose control. It processes business communications and may hold mail archives, administrative credentials, and connections to internal services. An attacker who compromises that gateway can threaten far more than the availability of email filtering.

Fortinet's advisory FG-IR-26-175 addresses CVE-2026-104286. Crafted HTTP or HTTPS requests can let an unauthenticated attacker write arbitrary files to an affected FortiMail system. Fortinet assigns a CVSS 3.1 score of 9.8, and government advisories report active exploitation. The vulnerability is also listed in CISA's Known Exploited Vulnerabilities catalog. [1][2][3]

The response should cover two questions: Can an attacker still reach the vulnerable service? Has the appliance already been compromised? Restricting access and applying a fix address exposure. Reviewing historical logs, configuration changes, and network traffic helps address prior intrusion.

This article explains the risk, gives a practical investigation example, and proposes detection use cases for IBM QRadar and CrowdStrike Falcon Next-Gen SIEM, with supplementary Falcon endpoint hunts.

What the vulnerability allows

The published description identifies path traversal and improper handling of NULL bytes. Path traversal lets a request escape an intended directory; unsafe NULL-byte handling can cause software components to interpret a supplied value differently. In this case, the documented result is an unauthenticated arbitrary file write. Government advisories also identify remote code execution as a potential impact. [2][3][4]

An arbitrary file write does not, by itself, tell investigators which commands ran or which messages were stolen. Those conclusions require evidence from the affected environment. For defenders, however, it creates a reason to inspect files, persistence, administrative activity, and possible data transfer.

Affected releases and upgrade planning

The affected ranges are supported by the NVD description; the upgrade targets appear in CERT-FR's 2 October bulletin, which labels 8.0.2, 7.6.7, and 7.4.9 as upcoming. Confirm current firmware availability and the supported upgrade path with Fortinet before deployment. Moving to a newer release inside an affected range does not resolve the issue. [2][3]

The documented workaround disables Identity-Based Encryption (IBE): [4][5]

config system encryption ibe
    set status disable
end

Coordinate that change with the mail team: disabling IBE affects the secure-mail service. Restrict access to FortiMail's exposed HTTP/HTTPS services, including the webmail/IBE surface as applicable to the deployment, and keep administration limited to trusted access paths. Confirm the live advisory's interface-specific guidance; protecting only a separate administrator login should not be assumed to protect another exposed web service.

A concrete risk: email theft through remote archiving

The vendor indicators reproduced in NCSC-NL's advisory include a configuration event for an archive account named archive234, configured with remote destination 79.141.169.187 and directory /uploads. The same indicator set lists suspicious added or modified files and a second IP, 45.129.0.192. [6]

This provides a useful detection hypothesis: an attacker could abuse an appliance's legitimate archive function to move mail outside the organization. The configuration event is evidence of a setting change. Confirming successful theft still requires evidence that data reached the destination and an assessment of what the archive contained.

Illustrative investigation example

The following timeline is fictional and uses documentation IP addresses. It illustrates how to correlate evidence; it is not a reported victim incident or a reproduction of the exploit.

A shortened synthetic configuration event for a detection lab might look like this:

type=kevent subtype=config user=admin ui=cli
msg="Added 'archive_demo' to 'archive account' : destination[remote]remote-ip[203.0.113.50]remote-directory[/lab-archive]"

Each observation has limits. Suspicious input can be blocked. A remote archive can be authorized. An allowed connection does not prove email exfiltration. Together, an unapproved configuration change, a matching network session, and a malicious artifact justify a much stronger incident assessment.

Detection use cases for a SOC

For an MSSP, maintain the asset inventory, approved destinations, and correlation keys per customer. Include HA members, virtual appliances, and public-to-private NAT mappings. Correlate by customer and appliance identity, rather than combining unrelated events across tenants.

IBM QRadar: searches and correlation rules

Collect the evidence before writing the rule

IBM documents a Fortinet FortiMail DSM using Syslog. Configure the relevant log sources and verify that configuration and administrative events arrive, retain their full messages, and parse correctly for the firmware in use. Diagnostic IBE messages may need additional vendor-supported collection; do not assume every published diagnostic indicator appears in ordinary Syslog. [7]

Also collect firewall events and, where available, flows and request-content logs. Plain encrypted network traffic does not expose HTTP paths or request bodies.

For the searches below:

• Replace 12345 with the actual FortiMail log source ID. Use an IN list for multiple appliances.
• Start with a short search window, then extend across available retention. Seven days is an example, not a known campaign start date.
• Check device identity separately: sourceip in an appliance event may represent a client, not the appliance itself.
• These are AQL hunt templates, not imported CRE rules. They use documented payload filtering and reference-set functions. Validate them on local events before operational use. [8][9]

Search 1: remote archive configuration events

SELECT starttime,
       LOGSOURCENAME(logsourceid) AS 'Log Source',
       username,
       UTF8(payload) AS 'Raw Event'
FROM events
WHERE logsourceid = 12345
  AND UTF8(payload) ILIKE '%archive account%'
  AND UTF8(payload) ILIKE '%destination[remote]%'
ORDER BY starttime DESC
LAST 7 DAYS

This surfaces remote archive account events without relying on the observed account name. Inspect the destination and compare it with approved archive servers. Different configuration actions can produce different wording, so extend the logic after reviewing actual change events.

Search 2: contextual appliance indicators

SELECT starttime,
       LOGSOURCENAME(logsourceid) AS 'Log Source',
       UTF8(payload) AS 'Raw Event'
FROM events
WHERE logsourceid = 12345
  AND (
       UTF8(payload) ILIKE '%archive234%'
       OR (UTF8(payload) ILIKE '%DecrypterMediaIn%'
           AND UTF8(payload) ILIKE '%Invalid Base64 Encoding%')
       OR (UTF8(payload) ILIKE '%ui=cron%'
           AND UTF8(payload) ILIKE '%/migadmin%')
       OR (UTF8(payload) ILIKE '%user=admin%'
           AND UTF8(payload) ILIKE '%ui=(null)%'
           AND UTF8(payload) ILIKE '%action=logout%')
  )
ORDER BY starttime DESC
LAST 7 DAYS

The strings come from the published indicator set. Treat these results as investigation leads: IBE decoding failures and administrative anomalies alone do not prove compromise. Absence of results is inconclusive if the relevant logs were never collected. [6]

Search 3: normalized network indicator matches

Create an IP reference set named FortiMail_CVE_2026_104286_IPs containing 79.141.169.187 and 45.129.0.192. Run this search against network events, then correlate matches with the FortiMail asset inventory. [6]

SELECT starttime,
       LOGSOURCENAME(logsourceid) AS 'Log Source',
       sourceip,
       destinationip,
       QIDNAME(qid) AS 'Event Name',
       UTF8(payload) AS 'Raw Event'
FROM events
WHERE REFERENCESETCONTAINS('FortiMail_CVE_2026_104286_IPs', sourceip)
   OR REFERENCESETCONTAINS('FortiMail_CVE_2026_104286_IPs', destinationip)
ORDER BY starttime DESC
LAST 7 DAYS

This searches normalized IP fields. It will not reliably find an address embedded only in a configuration message; extract remote-ip into a custom property for that use case. Add network-log-source and appliance filters once the mappings are verified.

Turn the hunts into CRE rule designs

These thresholds are proposed starting points. Create extraction properties for archive destination, account, and device identity. For dynamic destination correlation, use a customer-specific reference map or equivalent supported CRE design that associates the appliance with its recently changed destination and expires entries after the intended window. A time-only match between unrelated events is insufficient.

Use exact scoped exceptions for approved destinations and changes. Do not broadly suppress configuration events from the admin account.

CrowdStrike: appliance log detection and endpoint hunting

There are two distinct telemetry paths. Falcon Next-Gen SIEM or LogScale can search imported FortiMail and network logs. Falcon endpoint hunts depend on events from supported systems where the sensor is deployed. These examples do not assume a Falcon sensor can be installed on FortiMail or that endpoint telemetry provides appliance filesystem visibility.

The following examples use CrowdStrike Query Language, or CQL. CrowdStrike documents field filters, in(), and table() for these searches. [10][11]

Query 1: remote archive activity in imported FortiMail logs

Select a view restricted to FortiMail logs, or replace YOUR_FORTIMAIL_REPOSITORY with your repository name. Confirm the parser preserves the message in @rawstring; adapt the field if necessary.

#repo="YOUR_FORTIMAIL_REPOSITORY"
| @rawstring=/archive account/i
| @rawstring=/destination\[remote\]/i
| table([@timestamp, @rawstring], limit=200)

This is a broad review query. For continuous detection, extract the remote archive IP and compare it with the approved list, scoped to the customer and appliance. Do not treat a permitted archive configuration as malicious solely because it matches these strings.

Query 2: contextual FortiMail patterns

#repo="YOUR_FORTIMAIL_REPOSITORY"
| @rawstring=/archive234|DecrypterMediaIn.*Invalid Base64 Encoding|ui=cron.*\/migadmin|user=admin.*ui=\(null\).*action=logout/i
| table([@timestamp, @rawstring], limit=200)

This template assumes the relevant strings remain together in one raw event and in the illustrated order. Multiline splitting, altered field order, or a different parser can cause misses. Review the individual events before adapting it into an alert. The queried indicators are documented in the NCSC-NL reproduction of Fortinet's list. [6][10]

Query 3: indicator contact from sensor-covered endpoints

Run this against Falcon endpoint data in Advanced Event Search or the appropriate Next-Gen SIEM view. CrowdStrike's own examples use NetworkConnectIP4 and RemoteAddressIP4 for endpoint network connections. [12]

#event_simpleName=NetworkConnectIP4
| in(field="RemoteAddressIP4", values=[
    "79.141.169.187",
    "45.129.0.192"
  ])
| table([@timestamp, aid, ComputerName, ContextProcessId,
         RemoteAddressIP4, RemotePort], limit=200)

A match identifies an endpoint connection to an indicator. Investigate the process and surrounding activity. It does not show FortiMail's own outbound connection unless that activity is available through a separate log source. For gateway traffic, build the equivalent search over imported firewall logs using the parser's actual source and destination IP fields.

Query 4: executed binary hash matches on endpoints

The following three SHA-256 values correspond to the published modified /bin/smit and added webconsole and mailservice artifacts. [6]

#event_simpleName=ProcessRollup2
| in(field="SHA256HashData", ignoreCase=true, values=[
    "77324ac428bde86d351fc5fc06f6d64a6bfe737dfb2743df1d4c5ac2418a5b6a",
    "7a6cea9f5c9e2e9994d4e3c4da73f86cf5acd05ea5d312c066c9d1dafd69ee38",
    "4000276a150a165d3c2537d1e19fb393c4de8333076a16655e28059cae82157b"
  ])
| table([@timestamp, aid, ComputerName, ImageFileName,
         CommandLine, SHA256HashData], limit=200)

This is a supplementary hunt for a matching binary executing on a sensor-covered endpoint. It is not a filesystem scan and cannot rule out malicious files on FortiMail. Collect appliance artifacts through a supported investigation process. CrowdStrike documents the process event and hash field; local availability and retention still need checking. [13]

Before promoting searches into correlation rules or scheduled alerts, confirm the relevant feature is enabled for the target tenant, validate the repository and fields, and test against known events. Do not assume parent-tenant access establishes availability on every MSSP child tenant.

Published artifacts worth checking

The official NCSC-NL indicator reproduction identifies these appliance paths. Its full record includes hashes for all seven artifacts. [6]

A matching malicious hash is stronger than a filename match. A nonmatching hash does not establish that an appliance is clean: files can change, and the public indicator set may not cover every intrusion.

A response plan for affected organizations

1. Inventory exposure. Identify every FortiMail appliance, firmware version, IBE setting, exposed web service, HA member, and NAT mapping.
2. Contain reachable attack paths. Apply the documented workaround or access restrictions promptly, with the mail owner involved. Test the affected mail workflows.
3. Preserve evidence while containing the risk. Export available audit, configuration, web, and network logs. Coordinate supported forensic collection before destructive cleanup or rebuilding; evidence collection should not delay urgent access restrictions.
4. Hunt historical activity. Review archive destinations, accounts, published indicators, file integrity, and connections across all available retention. Establish what was visible and what was missing.
5. Investigate suspected compromise. If evidence supports intrusion, involve incident response and Fortinet support. Determine persistence, affected credentials, mail access, and transfers before declaring the incident closed.
6. Recover and verify. Install an available fixed release using the supported path, or rebuild when indicated. Review credential rotation and downstream access, validate mail service, and confirm logging and detections continue to work.

CISA's catalog lists 4 October 2026 as the remediation due date for this entry. That date belongs to the applicable US federal requirements; organizations elsewhere should use active exploitation and their own exposure to prioritize action. [2]

The QMasters perspective

Email gateway security needs visibility into the gateway itself. Endpoint protection, firewall monitoring, and vulnerability management each supply part of the evidence. Configuration auditing fills a particularly important gap when an attacker uses a legitimate feature to move sensitive data.

For this advisory, a useful SOC outcome is a traceable investigation: which appliance was exposed, which settings changed, which destinations it contacted, and whether any published artifacts were found. Pairing those findings with mitigation and verified recovery gives the organization a defensible incident assessment.

Need help assessing FortiMail exposure or implementing these detection use cases? Contact QMasters for support with SOC monitoring, threat hunting, and incident response.

Less Drama, More Detection.

Sources

1. Fortinet PSIRT — FG-IR-26-175
2. NIST NVD — CVE-2026-104286, including CVSS and CISA KEV entry
3. CERT-FR — CERTFR-2026-AVI-1257, 2 October 2026
4. CERT-In — CIVN-2026-0487, vulnerability and workaround
5. Fortinet CLI reference — system encryption ibe
6. NCSC-NL — NCSC-2026-0398 CSAF record with reproduced Fortinet indicators
7. IBM QRadar — Fortinet FortiMail Syslog log source parameters
8. IBM QRadar — AQL LIKE and ILIKE
9. IBM QRadar — AQL data retrieval functions, including REFERENCESETCONTAINS
10. CrowdStrike Query Language — regex and field filter syntax
11. CrowdStrike Query Language — in() and table()
12. CrowdStrike — Next-Gen SIEM network connection query example
13. CrowdStrike — documented process and SHA256HashData hunting fields