FortiMail 7.4.0 Through 7.4.8

An authenticated remote command injection vulnerability in Fortinet FortiMail allows administrators to execute arbitrary commands as root and manipulate user accounts on paired FortiAuthenticator devices.

An argument injection vulnerability in the administrative interface of Fortinet FortiMail allows authenticated remote attackers with admin privileges to achieve arbitrary code execution as root and perform unauthorized actions on paired FortiAuthenticator devices.

An authorization bypass vulnerability in Fortinet FortiMail allows an unauthenticated attacker to release or delete quarantined messages for arbitrary mailboxes via a crafted request.

An unauthenticated remote attacker can bypass authorization in Fortinet FortiMail to take over an arbitrary Identity-Based Encryption (IBE) recipient account by sending crafted HTTP requests.

CVE-2026-126153 is a path traversal vulnerability in multiple versions of Fortinet FortiMail that allows unauthenticated attackers to execute unauthorized commands via crafted requests.