CVE-2026-126146: OS Command Injection

Published Nov 11, 2026

Updated

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.4, FortiMail 7.4.0 through 7.4.6, FortiMail 7.2.0 through 7.2.9, FortiRecorder 7.6.0, FortiRecorder 7.2.0 through 7.2.11, FortiRecorder 7.0.0 through 7.0.6 may allow an authenticated privileged attacker to execute unauthorized code or commands via a specifically crafted archive account configuration.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FortiMail to a version that resolves this vulnerability.
Fixed in 7.4.7
Upgrade
Upgrade FortiMail to a version that resolves this vulnerability.
Fixed in 7.6.5
Upgrade
Upgrade FortiMail to a version that resolves this vulnerability.
Fixed in 8.0.2
Upgrade
Upgrade FortiMail to a version that resolves this vulnerability.
Fixed in 7.2.10
Upgrade
Upgrade FortiRecorder to a version that resolves this vulnerability.
Fixed in 7.0.7
Upgrade
Upgrade FortiRecorder to a version that resolves this vulnerability.
Fixed in 7.2.13
Upgrade
Upgrade FortiRecorder to a version that resolves this vulnerability.
Fixed in 7.6.3

Event History

Nov 11, 2026

CVE Published

via MITRE·09:28 PM

Data Sourced

via MITRE·09:28 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

FortiMail is affected in versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.4, 7.4.0 through 7.4.6, and 7.2.0 through 7.2.9. FortiRecorder is affected in version 7.6.0, versions 7.2.0 through 7.2.11, and versions 7.0.0 through 7.0.6.

What access does an attacker need to exploit this issue?

The attacker must be authenticated and have privileged access. Exploitation requires submitting a specifically crafted archive account configuration.

What could a successful exploit allow?

A successful exploit may allow the privileged attacker to execute unauthorized code or operating-system commands. The reported impact includes high confidentiality, integrity, and availability impact.

CVE-2026-126146: OS Command Injection

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What access does an attacker need to exploit this issue?

What could a successful exploit allow?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What access does an attacker need to exploit this issue?

What could a successful exploit allow?