Fortinet Exploited CVEs 2026: FortiMail CVE-2026-104286, FortiOS, FortiSandbox

Published 2026-10-08 · Last updated 2026-10-08

What’s affected

CVE	Product	Affected versions (per Fortinet)
CVE-2026-104286	FortiMail	8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8, 7.2.0–7.2.9
CVE-2025-25249	FortiOS, FortiSwitchManager	FortiOS 7.6.0–7.6.3, 7.4.0–7.4.8, 7.2.0–7.2.11, 7.0.0–7.0.17, all 6.4; FortiSwitchManager 7.2.0–7.2.6, 7.0.0–7.0.5
CVE-2025-68686	FortiOS	7.6.0–7.6.1, 7.4.0–7.4.6, all 7.2, all 7.0, all 6.4
CVE-2026-25089	FortiSandbox	5.0.0–5.0.5, 4.4.0–4.4.8, all 4.2; Cloud/PaaS 5.0.4–5.0.5
CVE-2026-39808	FortiSandbox	4.4.0–4.4.8

CVE-2025-68686 needs a closer look. In earlier Fortinet incidents, attackers who got in planted a symbolic link that kept read access to the device’s files even after it was patched. Fortinet removed that backdoor in an update; this CVE is a way around that fix. It only helps an attacker who has already compromised the device, so if your FortiGate was ever exposed on an old version, assume the backdoor may still be there until you’re on a fixed release.

Note that FortiOS 7.2, 7.0 and 6.4 are listed as affected in all versions for CVE-2025-68686. Upgrading to a supported branch is the fix.

Am I affected?

get system status        # FortiOS / FortiMail / FortiSandbox CLI: shows the version

Compare against the table. If you manage multiple devices through FortiManager or FortiCloud, the firmware column there gives you the whole fleet at once.

How to patch

1. Check the FortiGuard advisory for your product (linked below) for the exact fixed build on your branch, and use Fortinet’s upgrade path tool. FortiOS often requires stepping through intermediate versions.
2. Back up the config (execute backup config), upgrade, and confirm with get system status.
3. On FortiOS, confirm the symlink cleanup ran: after upgrading to a fixed version, the device removes known malicious symlinks from the SSL-VPN language-file area automatically.

Reduce exposure

• Never expose the management interface (HTTPS/SSH admin) to the internet. Restrict it with trusted hosts on each admin account and with local-in policies.
• FortiMail’s web interface should only be reachable from where admins and webmail users actually are.
• If you don’t use SSL-VPN, disable it. Fortinet has moved many customers to IPsec for this reason.

Check for compromise

• Review admin accounts, local users and recent config changes (diagnose sys config-log / the event logs).
• On FortiMail, look for unfamiliar files in the web root and unexpected mail rules or forwarding addresses.
• If a device was exposed on a vulnerable version, Fortinet’s guidance for confirmed compromise is a clean firmware reinstall, a reviewed config restore, and rotation of all credentials and VPN secrets.

Sources

• FortiGuard PSIRT: FG-IR-26-175 (FortiMail), FG-IR-25-084 (FortiOS heap overflow), FG-IR-25-934 (symlink bypass), FG-IR-26-141 and FG-IR-26-100 (FortiSandbox)
• CISA Known Exploited Vulnerabilities catalog

← Back to Knowledge Base