Hunt FortiMail CVE-2026-104286: archive234, ld.so.preload, and Bad Base64

Fortinet’s FortiMail path-traversal-plus-NULL-byte bug (CVE-2026-104286, FG-IR-26-175) landed on CISA KEV October 1 with a federal due date of October 4. CVSS 9.8. Unauthenticated file write over HTTP/HTTPS. Patches and cloud auto-fixes rolled through early October, but “we patched” is not the same as “nobody lived here.” This lab walkthrough hunts the IOCs Fortinet published: the archive234 remote archive account, ld.so.preload toys, IBE Base64 freakouts, and the two attacker IPs. Screenshots are Kali-dark on purpose. Your SIEM can wear a tie later.

Quick context if you skipped the advisory: affected trains included FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9. Fixes target 8.0.2, 7.6.7, 7.4.9; 7.2 should move to 7.4+. Workarounds included disabling IBE encryption features or yanking internet exposure from the webmail/management surfaces, and WAF rules blocking POSTs to /ibe that contain ../. FortiMail Cloud was updated by Fortinet (firmware to 7.6.7 GA or 8.0.2 GA) so cloud customers were told no action was required for the patch itself. On-prem was your problem.

What Fortinet said to look for

• Added /data/lib/liblog.so SHA-256 8015f34dc84922b03688399d7f9fe7a00361789f7e420c7e2a2cdb23e75cef84
• Modified /bin/smit SHA-256 77324ac428bde86d351fc5fc06f6d64a6bfe737dfb2743df1d4c5ac2418a5b6a
• Added /data/bin/webconsole SHA-256 7a6cea9f5c9e2e9994d4e3c4da73f86cf5acd05ea5d312c066c9d1dafd69ee38
• Added /data/bin/mailservice SHA-256 4000276a150a165d3c2537d1e19fb393c4de8333076a16655e28059cae82157b
• Modified /data/etc/httpd.conf SHA-256 703e97c64e61e41dc3aaba580d82bb2aa7b6a11b54ee6fb467ed5d5a3bffdef5
• Added /data/etc/ld.so.preload SHA-256 8953ec7960b09f544a880b072ad4e6cfda7a8303f486251d3478dcfdfbac23b6
• Modified /data/migadmin.tar.gz SHA-256 d6fe51c22b91776f4c961ea58bcac5917f15d560a619d7ce726d3d51795609d3
• Attack IPs: 79.141.169.187, 45.129.0.192
• Config tell: archive account archive234 shipping to 79.141.169.187 remote directory /uploads
• Log tells: cron touching /migadmin, weird admin logout from (null), IBE decoder screaming about invalid Base64 with character 0x2a, odd failed logins for *@domain

Lab setup

We dropped a ten-line synthetic log that mixes noise with Fortinet-shaped events, plus two planted files whose SHA-256 match the advisory. No appliance was scanned. The point is teaching the greps and the hash check so you can rerun them on real evidence stores.

Step 1: string hunt

grep -E 'archive234|ld\.so\.preload|Invalid Base64|/ibe/' fortimail_lab.log

In the lab you should see the archive234 remote-ip line, the IBE Base64 exception, and POSTs that walk /ibe/../ into sensitive paths. On a real box or SIEM, widen retention and include config-change events, not just httpd access.

Step 2: IP and archive destination extraction

awk '/remote-ip\[/{match($0,/remote-ip\[([^]]+)\]/a); print substr($0,RSTART+10,RLENGTH-11)}' fortimail_lab.log
grep -oE 'from [0-9.]+' fortimail_lab.log | sort | uniq -c | sort -rn
printf '%s\n' 79.141.169.187 45.129.0.192 | tee iocs.txt

Any archive account you did not create that points at hosting IPs is an incident, not a curiosity. Correlate httpd sources with those IPs even if the path traversal strings were rotated.

Step 3: hash the suspicious paths

On a forensic image or a read-only mount (not on a live production flail), compare SHA-256 of the paths Fortinet listed. Our lab script prints HIT when hashes match the advisory. A miss does not mean clean. It means that exact implant sample was absent. Still look for unexpected ld.so.preload, mystery webconsole / mailservice binaries, and httpd.conf drift.

Drop these detections in the SIEM

• Config events creating archive accounts with destination[remote] to unfamiliar IPs
• Any reference to account name archive234 (rename variants will appear; alert on remote archive adds broadly)
• HTTP POSTs to /ibe containing ../ or NULL-byte weirdness
• IBE decoder errors citing invalid Base64 at position 0 with unusual characters
• Cron lines invoking /migadmin packaging
• Admin logout or login events with ui=(null) / empty source
• Outbound connections from the appliance to 79.141.169.187 or 45.129.0.192 (and your updated threat-intel set)

What to actually do on real gear

1. Confirm firmware. Cloud customers: verify Fortinet’s auto-update landing. On-prem: emergency change.
2. Pull configs and logs back to at least the advisory week. Search for the strings above.
3. If IOCs hit, assume credential and mail-flow compromise. Rotate admin creds, review archive and routing rules, check for redirected mail, engage IR.
4. Keep internet off the management/webmail planes unless you enjoy repeating this article in Q1.
5. Track CISA BOD 26-04 forensic triage expectations if you are in federal scope. Everyone else should still act like triage matters.

Mapping the workaround to monitoring

Fortinet’s temporary brakes were: disable IBE, or keep the web interfaces off the public internet, or WAF-block POST /ibe with ../. If you relied on the WAF path, log the blocks. A sudden spike in blocked traversal POSTs after disclosure is either scanners or someone who has not read the room. If you disabled IBE, document who approved it and when you re-enable after upgrade, or you will inherit a silent functional outage six weeks later when someone asks why encrypted mail workflows died.

Forensic triage priorities

1. Capture volatile config: archive accounts, routes, admin users, cron, httpd.conf, presence of ld.so.preload
2. Hash the seven paths from the advisory; keep originals
3. Export logs covering at least a week before the first public advisory noise
4. Review outbound connections from the appliance during that window
5. Assume mailbox access may have been abused even if implants are gone; look for rule changes and suspicious forwards

CISA’s BOD 26-04 language around forensic triage before declaring victory is aimed at federal civilian agencies, but the idea is portable: patching a box that still has a preload hook is interior decorating.

Sloth take

Email gateways are where organizations store both their crown jewels and their denial. An unauthenticated file write on the box that reads everyone’s mail is not a “medium priority after payroll.” Fortinet handed you hashes, IPs, and a cartoonishly named archive234 account. If your detection strategy is waiting for a branded EDR pop on a FreeBSD appliance, enjoy the press release later. Grep first. Patch second. Then go yell at whoever exposed /ibe to the whole internet.

Need a grown-up to look at your edge stack? Book a slot with Dark Edge Consulting. We do the boring, careful work so you can go back to ignoring your inbox.

Sources

• Fortinet PSIRT FG-IR-26-175 / CVE-2026-104286
• BleepingComputer, Fortinet warns of critical FortiMail flaw exploited in zero-day attacks (2026-10-01): bleepingcomputer.com
• Help Net Security, Critical FortiMail zero-day exploited in the wild (2026-10-02)
• CISA KEV entry for CVE-2026-104286 (added 2026-10-01, due 2026-10-04)