The mail gateway had no build

The advisory and the exploit landed before the version number.

Fortinet’s FG-IR-26-175, out today, describes CVE-2026-104286 as a path traversal plus a NULL-byte handling bug. An unauthenticated attacker can write arbitrary files on the system through crafted web requests. Fortinet rates it critical, 9.8, and says the impact is unauthorized code or commands. It says the bug has been reported exploited in the wild. The ranges are FortiMail 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8, and 7.2.0–7.2.9. The fixed builds are named as upcoming, not as something you can download this afternoon. CISA put it on the KEV list the same day and told civilian federal agencies to finish, triage included, by 4 October. Ransomware use is marked unknown.

Until a build exists, Fortinet’s own mitigation is to turn identity-based encryption off, or to take the webmail interface off the internet and leave it on a trusted network. I am not repeating the request pattern. The point is the direction: the exposed door closes, or the feature that is the door goes off.

What a change window will try to do instead

It will wait for 7.6.7, or 7.4.9, or 8.0.2, because “apply the vendor patch” is the sentence in the ticket template. The ticket template does not have a row for “the patch is not a file yet, and the box is on the KEV list.” A mail gateway is also the thing that sees every message you meant to keep off the corporate desktop. Leaving the interface up until the build is posted is a bet that the people already using the bug will pause for your CAB meeting.

7.2 does not get a fix inside the branch. Fortinet’s answer for that line is to move to 7.4 or newer. “We’re on a supported build” is how 7.2 stays in the range.

If the appliance is yours, the question tonight is whether the webmail face is reachable from anywhere you do not own. The version string can wait until they publish one. The interface cannot.