Fortinet FortiMail: OS command injection (CVE-2026-126158)
An authenticated administrator can exploit improper input sanitization in Fortinet FortiMail versions 8.0.0 through 8.0.1 to execute arbitrary commands with root privileges via crafted HTTP requests.
CVE search metadata
CVE search record: CVE-2026-126158. Severity: high. CVSS: 7.2. KEV: no. Product: FortiMail (8.0.0 through 8.0.1). Brief: Fortinet FortiMail: OS command injection (CVE-2026-126158). Brief link: https://feed.craftedsignal.io/briefs/2026-11-fortinet-fortimail-cve-2026-126158/
Triage facts
Revision 1- Applicability
- FortiMail (8.0.0 through 8.0.1)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 00:11 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Fortinet FortiMail versions 8.0.0 through 8.0.1 are affected by an OS command injection vulnerability (CVE-2026-126158). The flaw stems from improper neutralization of special elements within HTTP requests. An authenticated administrator can leverage this vulnerability to execute unauthorized code or commands with root-level privileges.
Impact
Successful exploitation allows an authenticated administrator to achieve remote code execution as the root user on the affected appliance. This grants the attacker full control over the compromised device.
Recommendation
Inventory all Fortinet FortiMail instances in the environment and determine if they are running versions 8.0.0 or 8.0.1. Apply vendor-provided patches or updates immediately once available to remediate this vulnerability. Restrict access to administrative interfaces to trusted management subnets only.
Immediate actions
Inventory all FortiMail appliances to identify versions 8.0.0 and 8.0.1
Threat Hunt
Investigate administrative HTTP request logs for unusual shell metacharacters (e.g., ;, |, &, $, `) in parameters handled by administrative endpoints.
Data: Web server access logs, Application logs for administrative interface
Mitigations
Restrict access to administrative management interfaces to trusted source IPs
CVE-2026-126158