{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/fortimail-7.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-126167"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FortiMail 8.0.0 through 8.0.2","FortiMail 7.6.0 through 7.6.6","FortiMail 7.4.0 through 7.4.8","FortiMail 7.2"],"_cs_severities":["high"],"_cs_tags":["cve","vulnerability","network"],"_cs_type":"advisory","_cs_vendors":["Fortinet"],"content_html":"\u003cp\u003eFortinet FortiMail versions 8.0.0 through 8.0.2, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2 contain a command injection vulnerability (CVE-2026-126167) due to improper neutralization of special elements in the administrative interface. An attacker with domain admin or admin privileges can exploit this via crafted HTTP requests.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated attacker to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root, execute arbitrary CLI commands, and read or write arbitrary files as root.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eReview and audit administrative accounts and current session activity for all FortiMail instances.\u003c/li\u003e\n\u003cli\u003eMonitor administrative interface access logs for unusual HTTP request patterns from administrator accounts.\u003c/li\u003e\n\u003cli\u003eRestrict access to the FortiMail administrative interface to authorized networks and known management IP addresses.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-11-12T00:15:32Z","date_published":"2026-11-12T00:15:32Z","id":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-126167/","summary":"An authenticated remote command injection vulnerability in Fortinet FortiMail allows administrators to execute arbitrary commands as root and manipulate user accounts on paired FortiAuthenticator devices.","title":"Fortinet FortiMail: Command injection vulnerability (CVE-2026-126167)","url":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-126167/"}],"language":"en","title":"CraftedSignal Threat Feed - FortiMail 7.2","version":"https://jsonfeed.org/version/1.1"}