CVE-2026-126145: OS Command Injection
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated administrator with system-time read-write access to execute unauthorized code or commands as root.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fortinet FortiMailto a version that resolves this vulnerability.Fixed in 7.4.9 - Upgrade
Upgrade
Fortinet FortiMailto a version that resolves this vulnerability.Fixed in 7.6.7 - Upgrade
Upgrade
Fortinet FortiMailto a version that resolves this vulnerability.Fixed in 8.0.2
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
Exploitation requires an authenticated FortiMail administrator account with system-time read-write access. It is not described as exploitable by unauthenticated or lower-privileged users.
What level of access can successful exploitation provide?
A successful attacker may execute unauthorized code or commands as root, which can affect confidentiality, integrity, and availability of the appliance.
Which FortiMail releases are affected?
Affected releases are FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all FortiMail 7.2 versions.
What access should be restricted while remediation is pending?
Restrict system-time read-write permissions to only strictly necessary administrator accounts. Review accounts holding that permission because those accounts meet the stated prerequisite for exploitation.