Fortinet FortiMail: Argument injection via administrative interface (CVE-2026-126169)
An argument injection vulnerability in Fortinet FortiMail administrative interfaces allows an authenticated domain admin or administrator to execute arbitrary code and CLI commands as root, and perform unauthorized operations on paired FortiAuthenticator devices.
CVE search metadata
CVE search record: CVE-2026-126169. Severity: high. CVSS: 7.2. KEV: no. Product: FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions. Brief: Fortinet FortiMail: Argument injection via administrative interface (CVE-2026-126169). Brief link: https://feed.craftedsignal.io/briefs/2026-11-fortimail-arg-injection-cve-2026-126169/
Triage facts
Revision 1- Applicability
- FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6 +2
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 02:10 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
CVE-2026-126169 is an argument injection vulnerability in the administrative interface of Fortinet FortiMail. The vulnerability allows an authenticated remote attacker with domain admin or admin privileges to execute arbitrary CLI commands, execute arbitrary code as root, and read or write arbitrary files as root. Additionally, the flaw allows an attacker to delete users of other tenant domains on a paired FortiAuthenticator.
Impact
Successful exploitation via crafted HTTP requests permits unauthorized system-level operations and cross-tenant user manipulation on paired FortiAuthenticator devices.
Recommendation
Review the vendor advisory for applicable updates and security guidance regarding administrative access to FortiMail and FortiAuthenticator systems.