CVE-2026-126148: OS Command Injection
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted HA join-request packets.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fortinet FortiMailto a version that resolves this vulnerability.Fixed in 7.6.7 - Upgrade
Upgrade
Fortinet FortiMailto a version that resolves this vulnerability.Fixed in 8.0.2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
FortiMail versions 8.0.0 through 8.0.1 and 7.6.0 through 7.6.6 are identified as affected. Exposure requires that the appliance can receive crafted HA join-request packets.
Does exploitation require credentials or user interaction?
No. The vulnerability is described as exploitable by an unauthenticated attacker, and no user interaction is required.
What could a successful attacker do?
A successful attacker may execute unauthorized code or commands on the affected FortiMail system. The listed impacts include high confidentiality, integrity, and availability impact.