Impact

Successful exploitation allows an authenticated attacker to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root, execute arbitrary CLI commands, and read or write arbitrary files as root.

Recommendation

1. Review and audit administrative accounts and current session activity for all FortiMail instances.
2. Monitor administrative interface access logs for unusual HTTP request patterns from administrator accounts.
3. Restrict access to the FortiMail administrative interface to authorized networks and known management IP addresses.

Impact

Successful exploitation allows authenticated administrative users to gain root access to the affected appliance and manipulate user data on integrated authentication systems.

Recommendation

Review administrative access to the FortiMail management interface and ensure only authorized personnel have high-level privileges.