CVE-2026-126166: High severity vulnerability
A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fortinet FortiMailto a version that resolves this vulnerability.Fixed in 7.4.9 - Upgrade
Upgrade
Fortinet FortiMailto a version that resolves this vulnerability.Fixed in 7.6.7 - Upgrade
Upgrade
Fortinet FortiMailto a version that resolves this vulnerability.Fixed in 8.0.3
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to the FortiMail administrative interface and have domain admin or admin privileges. The attack can be performed remotely using crafted HTTP requests.
Which deployments are affected?
Affected releases are FortiMail 8.0.0 through 8.0.2, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all FortiMail 7.2 versions. The described cross-tenant user deletion impact applies where FortiMail is paired with FortiAuthenticator.
What could an attacker do after exploitation?
An attacker could execute arbitrary code as root, run arbitrary CLI commands, and read or write arbitrary files as root. In paired FortiAuthenticator environments, they may also delete users belonging to other tenant domains.