Fortinet FortiMail and FortiRecorder: OS Command Injection (CVE-2026-126146)
An OS command injection vulnerability in Fortinet FortiMail and FortiRecorder allows an authenticated, privileged attacker to execute unauthorized code or commands via a specifically crafted archive account configuration.
CVE search metadata
CVE search record: CVE-2026-126146. Severity: high. CVSS: 7.2. KEV: no. Product: FortiMail, FortiRecorder. Brief: Fortinet FortiMail and FortiRecorder: OS Command Injection (CVE-2026-126146). Brief link: https://feed.craftedsignal.io/briefs/2026-11-cve-2026-126146/
Triage facts
Revision 1- Applicability
- FortiMail, FortiRecorder
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 00:10 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
CVE-2026-126146 is an OS command injection vulnerability in Fortinet FortiMail (versions 8.0.0-8.0.1, 7.6.0-7.6.4, 7.4.0-7.4.6, 7.2.0-7.2.9) and FortiRecorder (versions 7.6.0, 7.2.0-7.2.11, 7.0.0-7.0.6). The vulnerability arises from the improper neutralization of special elements used in an OS command.
Impact
An authenticated privileged attacker may execute unauthorized code or commands via a specifically crafted archive account configuration.