Fortinet FortiMail: Command injection vulnerability (CVE-2026-126167)
An authenticated remote command injection vulnerability in Fortinet FortiMail allows administrators to execute arbitrary commands as root and manipulate user accounts on paired FortiAuthenticator devices.
CVE search metadata
CVE search record: CVE-2026-126167. Severity: high. CVSS: 7.2. KEV: no. Product: FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2. Brief: Fortinet FortiMail: Command injection vulnerability (CVE-2026-126167). Brief link: https://feed.craftedsignal.io/briefs/2026-11-cve-2026-126167/
Triage facts
Revision 1- Applicability
- FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6 +2
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 00:15 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Fortinet FortiMail versions 8.0.0 through 8.0.2, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2 contain a command injection vulnerability (CVE-2026-126167) due to improper neutralization of special elements in the administrative interface. An attacker with domain admin or admin privileges can exploit this via crafted HTTP requests.
Impact
Successful exploitation allows an authenticated attacker to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root, execute arbitrary CLI commands, and read or write arbitrary files as root.
Recommendation
- Review and audit administrative accounts and current session activity for all FortiMail instances.
- Monitor administrative interface access logs for unusual HTTP request patterns from administrator accounts.
- Restrict access to the FortiMail administrative interface to authorized networks and known management IP addresses.