Email security gateways occupy an interesting position in network architecture: they must inspect and process untrusted external content by design, yet they themselves are rarely treated as high-risk targets for vulnerability management. CVE-2026-104286 in FortiMail changes that calculation. A CVSS 9.8 path traversal vulnerability allows an unauthenticated attacker to write arbitrary files to the FortiMail filesystem, and in observed exploitation the attacker's file of choice has been /etc/ld.so.preload, a mechanism that provides persistent code execution on every subsequent process launch.
The vulnerability: path traversal with NULL byte abuse
The root cause is a path traversal flaw in FortiMail's administrative web interface. An attacker crafts a request containing traversal sequences (../) combined with a NULL byte (%00) to truncate the filename at a point that bypasses the application's file extension validation. The result: FortiMail writes attacker-controlled content to an attacker-specified path on the server filesystem, requiring no authentication credentials. Fortinet assessed CVSS 9.8 because the attack is network-reachable, unauthenticated, and results in full filesystem write access.
NULL byte injection as an attack technique predates modern application security frameworks by decades, appearing in CGI script vulnerabilities from the late 1990s. It remains effective when application code passes user input through functions from C standard libraries, which treat the null character as a string terminator. A validation routine written in a higher-level language may evaluate the full path including the extension, while the underlying file system call sees only the portion before the null byte.
ld.so.preload as a persistence mechanism
The Linux dynamic linker, ld.so, supports a preload mechanism via /etc/ld.so.preload: a plain text file listing shared libraries the linker loads before any library specified by the executable itself. This is a legitimate feature intended for debugging, profiling, and compatibility shims. Attackers abuse it because any shared library listed in ld.so.preload is loaded into every subsequently launched process, including privileged system services. Writing a backdoor shared library path to ld.so.preload achieves persistence that survives process restarts, survives most rootkit-detection approaches looking only at running processes, and requires only filesystem write access to establish.
In the FortiMail exploitation pattern, the attacker first uses CVE-2026-104286 to write a backdoor shared library to a writable path on the FortiMail filesystem, then uses a second request to overwrite /etc/ld.so.preload with a reference to that library. On the next process launch, the backdoor is loaded. Detection is straightforward in principle: an unexpected /etc/ld.so.preload file, or one with unexpected content, is an unambiguous indicator of compromise. The practical challenge is that FortiMail devices are often excluded from standard endpoint detection and response coverage.
Affected versions and remediation
Fortinet's advisory covers FortiMail versions 6.4, 7.0, 7.2, and 7.4 through specific subversions; the patch is available in the respective latest maintenance releases. Organizations should apply the patch immediately and, equally importantly, audit existing FortiMail deployments for signs of prior compromise. Applying a patch after compromise does not remove an already-established ld.so.preload backdoor: patch remediation and compromise assessment must be performed in parallel, not sequentially.
Immediate steps for FortiMail operators
Apply the Fortinet patch for CVE-2026-104286 immediately. Restrict administrative interface access to management VLANs or jump hosts; the FortiMail admin interface should never be reachable from untrusted networks. Check /etc/ld.so.preload on all FortiMail appliances: the file should not exist in a default deployment. Review FortiMail application logs for unusual file upload or path traversal patterns dating back at least 90 days. If an existing ld.so.preload is found, treat the appliance as compromised and initiate incident response procedures rather than simply removing the file. Consider whether email traffic processed by a potentially compromised appliance during the exposure window warrants further investigation.