critical advisory November 12, 2026

Fortinet FortiMail: Path traversal remote code execution (CVE-2026-126147)

An unauthenticated path traversal vulnerability (CVE-2026-126147) in multiple FortiMail versions allows attackers to execute arbitrary code or commands via crafted requests.

Triage facts

Revision 1

Applicability: FortiMail (8.0.0-8.0.1), FortiMail (7.6.0-7.6.6) +2
Evidence: Unknown
Severity: Critical
Action: Immediate escalation
Sources: 1 public source
Freshness: Revision 1Nov 12, 00:10 UTC
Vulnerabilities: 1 CVE
Source quality: A1Likely

A path traversal vulnerability exists in Fortinet FortiMail that allows an unauthenticated attacker to execute unauthorized code or commands. The issue is described as an improper limitation of a pathname to a restricted directory.

Impact

The vulnerability is assigned a CVSS v3.1 base score of 9.8, indicating a critical severity with potential for unauthenticated remote code execution on affected appliances.

Recommendation

Identify all internet-facing FortiMail appliances within the environment.
Review vendor documentation from Fortinet for patch availability for the affected versions and apply updates immediately.

Immediate actions

Inventory all FortiMail appliances and identify versions within the affected ranges (8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, 7.2).

IT Operations 24h

Threat Hunt

Monitor FortiMail administrative logs or web server access logs for anomalous requests containing path traversal sequences such as double-dots (../) or unusual character encodings pointing to sensitive system files.

T1059.003 high medium confidence hunt now

Data: FortiMail web access logs, System audit logs

Mitigations

Apply official firmware security updates provided by Fortinet for CVE-2026-126147.

immediate IT Operations

CVE-2026-126147