Fortinet FortiMail: OS command injection (CVE-2026-126148)
Fortinet FortiMail versions 8.0.0-8.0.1 and 7.6.0-7.6.6 are vulnerable to unauthenticated remote code execution via specially crafted High Availability join-request packets.
CVE search metadata
CVE search record: CVE-2026-126148. Severity: critical. CVSS: 9.8. KEV: no. Product: FortiMail (8.0.0-8.0.1), FortiMail (7.6.0-7.6.6). Brief: Fortinet FortiMail: OS command injection (CVE-2026-126148). Brief link: https://feed.craftedsignal.io/briefs/2026-11-fortimail-rce-cve-2026-126148/
Triage facts
Revision 1- Applicability
- FortiMail (8.0.0-8.0.1), FortiMail (7.6.0-7.6.6)
- Evidence
- Unknown
- Severity
- Critical
- Action
- Immediate escalation
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 00:10 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Fortinet FortiMail versions 8.0.0 through 8.0.1 and 7.6.0 through 7.6.6 contain an OS command injection vulnerability (CVE-2026-126148) resulting from improper neutralization of special elements in HA join-request packets. This allows an unauthenticated attacker to execute arbitrary commands on the affected appliance.
Impact
Successful exploitation results in unauthenticated remote code execution on the FortiMail appliance. The vulnerability is rated with a CVSS v3.1 base score of 9.8.
Recommendation
Inventory all instances of Fortinet FortiMail in the environment. Apply the official security patch provided by Fortinet for versions 8.0.0 through 8.0.1 and 7.6.0 through 7.6.6. Until patching is completed, verify if HA join-request traffic is restricted to trusted, internal network segments only to mitigate exposure to unauthenticated attackers.
Immediate actions
Inventory FortiMail appliances and apply patches for CVE-2026-126148.
Threat Hunt
Investigate network logs for unusual incoming HA (High Availability) synchronization or join-request packets from untrusted sources to FortiMail devices.
Data: Network traffic logs, FortiMail HA configuration logs