CVE-2026-126153: Path Traversal

Published Nov 11, 2026

Updated

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to execute unauthorized commands via crafted requests.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Fortinet FortiMail to a version that resolves this vulnerability.
Fixed in 7.4.9
Upgrade
Upgrade Fortinet FortiMail to a version that resolves this vulnerability.
Fixed in 7.6.7
Upgrade
Upgrade Fortinet FortiMail to a version that resolves this vulnerability.
Fixed in 8.0.2

Event History

Nov 11, 2026

CVE Published

via MITRE·09:29 PM

Data Sourced

via MITRE·09:29 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which FortiMail versions are affected?

Affected releases are FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all FortiMail 7.2 versions.

Does exploitation require authentication or user interaction?

No. The vulnerability can be exploited by an unauthenticated attacker using crafted requests, and no user interaction is required.

What is the potential impact of successful exploitation?

A successful attacker may execute unauthorized commands. The supplied severity vector indicates integrity impact, with no stated confidentiality or availability impact.