Fortinet FortiMail Argument Injection Vulnerability (CVE-2026-126166)
An argument injection vulnerability in the administrative interface of Fortinet FortiMail allows authenticated remote attackers with admin privileges to achieve arbitrary code execution as root and perform unauthorized actions on paired FortiAuthenticator devices.
CVE search metadata
CVE search record: CVE-2026-126166. Severity: high. CVSS: 7.2. KEV: no. Product: FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions. Brief: Fortinet FortiMail Argument Injection Vulnerability (CVE-2026-126166). Brief link: https://feed.craftedsignal.io/briefs/2026-11-fortimail-argument-injection-cve-2026-126166/
Triage facts
Revision 1- Applicability
- FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6 +2
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 00:15 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
CVE-2026-126166 is an improper neutralization of argument delimiters vulnerability in the administrative interface of Fortinet FortiMail. An authenticated remote attacker with domain admin or admin privileges can send crafted HTTP requests to perform arbitrary CLI commands, execute code as root, read or write arbitrary files, and delete users of other tenant domains on paired FortiAuthenticator instances.
Impact
Successful exploitation allows authenticated administrative users to gain root access to the affected appliance and manipulate user data on integrated authentication systems.
Recommendation
Review administrative access to the FortiMail management interface and ensure only authorized personnel have high-level privileges.