# The build arrived after the date

2026-10-05

Fortinet’s 5 October update names the FortiMail builds that fix CVE-2026-104286. The federal due date was 4 October, when those builds were still “upcoming.” 7.2 does not get a fix inside the branch.

Canonical: https://www.fabiocti.com/notes/the-build-arrived-after-the-date/
Author: Fabio Correia

Yesterday was the date. Today is the version.

Fortinet updated FG-IR-26-175 today and named the releases: 8.0.2, 7.6.7, and 7.4.9. On 1 October those same numbers were upcoming, and CISA had already told civilian federal agencies to be done by 4 October, with forensic triage, while the only available action was the workaround. Disable identity-based encryption, or take the webmail interface off the internet. Anyone who “met the KEV date” yesterday met it by closing a door, not by installing a build that did not exist.

7.2 is still the branch that does not get a patched 7.2. Fortinet’s answer is to move to 7.4 or newer. That branch is heading out of support on 10 November. “We will wait for the 7.2 fix” is a plan to miss both dates.

## What to do with a gateway that was only mitigated

The workaround is not a clean bill. It is a reduction. If the interface was reachable on 1, 2, 3, or 4 October, the triage CISA attached to the due date is the actual task: look for files that should not be there, and for commands the appliance should not have run. Installing 7.6.7 on 6 October does not answer 3 October. A scanner that flips the finding to green on the new version string will close the ticket the KEV line kept open on purpose.

If you turned IBE off and pulled the interface in, write down when. That timestamp is the start of the window you still have to review, not the end of it. Then upgrade. 7.2 moves branches. The others take the named build. Neither sentence is “we were compliant on the 4th, so we are finished on the 5th.”

The advisory grew a version number one day late. The logs did not.