{"id":"CVE-2026-126144","kind":"vulnerability","aliases":["CVE-2026-126144"],"related":[],"title":"Fortinet FortiMail, FortiRecorder, FortiVoice: authenticated OS command injection via crafted HTTP requests","description":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.4, FortiMail 7.4.0 through 7.4.6, FortiMail 7.2 all versions, FortiRecorder 7.6.0 through 7.6.2, FortiRecorder 7.2.0 through 7.2.12, FortiRecorder 7.0.0 through 7.0.6, FortiVoice 8.0.0 through 8.0.1, FortiVoice 7.4.0 through 7.4.2, FortiVoice 7.2.0 through 7.2.5, FortiVoice 7.0.0 through 7.0.8 may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.","summary":"Several Fortinet email security, call recording and voice products have an OS command injection flaw in their web interface. An attacker with a valid login can run unauthorized commands on the appliance by sending crafted HTTP requests.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiMail","fixed":["8.0.2"],"affected":">= 8.0.0, <= 8.0.1","ecosystem":"vendor"},{"name":"FortiMail 7.6","fixed":["7.6.5"],"affected":">= 7.6.0, <= 7.6.4","ecosystem":"vendor"},{"name":"FortiMail 7.4","fixed":["7.4.7"],"affected":">= 7.4.0, <= 7.4.6","ecosystem":"vendor"},{"name":"FortiMail 7.2","fixed":[],"affected":">= 7.2.0, < 7.3.0","ecosystem":"vendor"},{"name":"FortiRecorder","fixed":["7.6.3"],"affected":">= 7.6.0, <= 7.6.2","ecosystem":"vendor"},{"name":"FortiRecorder 7.2","fixed":["7.2.13"],"affected":">= 7.2.0, <= 7.2.12","ecosystem":"vendor"},{"name":"FortiRecorder 7.0","fixed":["7.0.7"],"affected":">= 7.0.0, <= 7.0.6","ecosystem":"vendor"},{"name":"FortiVoice","fixed":["8.0.2"],"affected":">= 8.0.0, <= 8.0.1","ecosystem":"vendor"},{"name":"FortiVoice 7.4","fixed":["7.4.3"],"affected":">= 7.4.0, <= 7.4.2","ecosystem":"vendor"},{"name":"FortiVoice 7.2","fixed":["7.2.6"],"affected":">= 7.2.0, <= 7.2.5","ecosystem":"vendor"},{"name":"FortiVoice 7.0","fixed":["7.0.9"],"affected":">= 7.0.0, <= 7.0.8","ecosystem":"vendor"}],"ecosystems":[],"tags":["appliance","authenticated","fortimail","fortinet","fortirecorder","fortivoice","infrastructure"],"not_affected_if":["unaffected-version"],"how_to_check":"Check the firmware version (CLI: get system status, or the web UI dashboard) against the affected ranges: FortiMail 8.0.0-8.0.1, 7.6.0-7.6.4, 7.4.0-7.4.6, all 7.2; FortiRecorder 7.6.0-7.6.2, 7.2.0-7.2.12, 7.0.0-7.0.6; FortiVoice 8.0.0-8.0.1, 7.4.0-7.4.2, 7.2.0-7.2.5, 7.0.0-7.0.8. Exploitation needs a valid login, so also restrict who can reach the admin/web interface.","fix":"FortiMail: upgrade to 8.0.2, 7.6.5 or 7.4.7 (7.2 has no fix in the 7.2 branch: migrate to a fixed release). FortiRecorder and FortiVoice fixes are listed as upcoming, not yet released: FortiRecorder 7.6.3, 7.2.13, 7.0.7; FortiVoice 8.0.2, 7.4.3, 7.2.6, 7.0.9. Fortinet lists no workaround and no virtual patch.","status":"open","published_at":"2026-11-11T22:17:11+00:00","first_seen_at":"2026-11-11T22:29:27+00:00","triaged_at":"2026-11-11T22:31:23+00:00","updated_at":"2026-11-11T22:49:37+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-11T22:31:23Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Fortinet FortiMail, FortiRecorder, FortiVoice: authenticated OS command injection via HTTP","impact":"high","summary":"Several Fortinet email security, call recording and voice products have an OS command injection flaw in their web interface. An attacker with a valid login can run unauthorized commands on the appliance by sending crafted HTTP requests.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortimail","fortirecorder","fortivoice","fortinet","appliance"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker runs unauthorized commands on the appliance","analyst_note":"Find the Fortinet PSIRT advisory for CVE-2026-126144 to confirm fixed versions and workarounds for each product line.","how_to_check":"- Check the installed FortiMail, FortiRecorder or FortiVoice version against the affected ranges listed in the NVD entry.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Organizations running affected FortiMail 8.0.0 to 8.0.1, 7.6.0 to 7.6.4, 7.4.0 to 7.4.6 or 7.2 (all versions), FortiRecorder 7.6.0 to 7.6.2, 7.2.0 to 7.2.12 or 7.0.0 to 7.0.6, and FortiVoice 8.0.0 to 8.0.1, 7.4.0 to 7.4.2, 7.2.0 to 7.2.5 or 7.0.0 to 7.0.8. The sources do not say which configurations are exposed to the web interface.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000809,"input_tokens":4740,"output_tokens":670,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Fortinet PSIRT advisory for CVE-2026-126144 to confirm fixed versions and workarounds for each product line.","search":"'-126144':15A,18A '-2026':14A,17A '7.0':30A,37A '7.0.0':124C,140C '7.0.6':126C '7.0.8':142C '7.2':25A,28A,35A,112C '7.2.0':120C,136C '7.2.12':122C '7.2.5':138C '7.4':23A,33A '7.4.0':108C,132C '7.4.2':134C '7.4.6':110C '7.6':21A '7.6.0':104C,116C '7.6.2':118C '7.6.4':106C '8.0.0':100C,128C '8.0.1':102C,130C 'allow':144C 'applianc':38B,76B 'attack':65B,147C 'authent':5A,39B,146C 'call':49B 'code':151C 'command':7A,57B,73B,92C,94C,153C 'craft':10A,79B,156C 'cve':13A,16A 'element':87C 'email':47B 'execut':149C 'flaw':59B 'fortimail':2A,19A,20A,22A,24A,40B,99C,103C,107C,111C 'fortinet':1A,41B,46B,98C 'fortirecord':3A,42B,115C,119C,123C 'fortirecorder':26A,27A,29A 'fortivoic':4A,43B,127C,131C,135C,139C 'fortivoice':31A,32A,34A,36A 'http':11A,80B,157C 'improp':83C 'infrastructur':44B 'inject':8A,58B,95C 'interfac':63B 'login':69B 'may':143C 'neutral':84C 'os':6A,56B,91C,93C 'product':53B 'record':50B 'request':12A,81B,158C 'run':71B 'secur':48B 'send':78B 'sever':45B 'special':86C 'specif':155C 'unauthor':72B,150C 'use':88C 'valid':68B 'version':114C 'via':9A,154C 'voic':52B 'vulner':96C 'web':62B","nicknames":[],"mitigations":[],"who_affected":"Teams running Fortinet FortiMail, FortiRecorder or FortiVoice appliances in the affected version ranges. An attacker needs valid credentials and sends crafted HTTP requests to the API/web interface to run commands. Fortinet states it is not known to be exploited. FortiMail Cloud is not mentioned for this advisory.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:49:37Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-196","run_id":3668},"how_to_check":{"at":"2026-11-11T22:49:37Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-196","run_id":3668},"who_affected":{"at":"2026-11-11T22:49:37Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-196","run_id":3668}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["70","72","74","76","fortimail","fortimail72","fortimail74","fortimail76","fortirecorder","fortirecorder70","fortirecorder72","fortivoice","fortivoice70","fortivoice72","fortivoice74"],"ptokens":["fortimail","fortirecorder","fortivoice"],"labels":["appliance","authenticated","fortimail","fortinet","fortirecorder","fortivoice","high","infrastructure"],"campaign_type":null,"search_a":"'-126144':15A,18A '-2026':14A,17A '7.0':30A,37A '7.2':25A,28A,35A '7.4':23A,33A '7.6':21A 'authent':5A 'command':7A 'craft':10A 'cve':13A,16A 'fortimail':2A,19A,20A,22A,24A 'fortinet':1A 'fortirecord':3A 'fortirecorder':26A,27A,29A 'fortivoic':4A 'fortivoice':31A,32A,34A,36A 'http':11A 'inject':8A 'os':6A 'request':12A 'via':9A","search_b":"'applianc':38B,76B 'attack':65B 'authent':39B 'call':49B 'command':57B,73B 'craft':79B 'email':47B 'flaw':59B 'fortimail':40B 'fortinet':41B,46B 'fortirecord':42B 'fortivoic':43B 'http':80B 'infrastructur':44B 'inject':58B 'interfac':63B 'login':69B 'os':56B 'product':53B 'record':50B 'request':81B 'run':71B 'secur':48B 'send':78B 'sever':45B 'unauthor':72B 'valid':68B 'voic':52B 'web':62B","search_c":"'7.0.0':124C,140C '7.0.6':126C '7.0.8':142C '7.2':112C '7.2.0':120C,136C '7.2.12':122C '7.2.5':138C '7.4.0':108C,132C '7.4.2':134C '7.4.6':110C '7.6.0':104C,116C '7.6.2':118C '7.6.4':106C '8.0.0':100C,128C '8.0.1':102C,130C 'allow':144C 'attack':147C 'authent':146C 'code':151C 'command':92C,94C,153C 'craft':156C 'element':87C 'execut':149C 'fortimail':99C,103C,107C,111C 'fortinet':98C 'fortirecord':115C,119C,123C 'fortivoic':127C,131C,135C,139C 'http':157C 'improp':83C 'inject':95C 'may':143C 'neutral':84C 'os':91C,93C 'request':158C 'special':86C 'specif':155C 'unauthor':150C 'use':88C 'version':114C 'via':154C 'vulner':96C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126144","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126144","severity":null,"published_at":"2026-11-11T22:17:11+00:00","modified_at":"2026-11-11T22:17:11+00:00","first_seen_at":"2026-11-11T22:29:27+00:00","fetched_at":"2026-11-11T22:29:27+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126144:3668","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-196","severity":null,"published_at":"2026-11-11T22:49:37+00:00","modified_at":"2026-11-11T22:49:37+00:00","first_seen_at":"2026-11-11T22:49:37+00:00","fetched_at":"2026-11-11T22:49:37+00:00","note":"Read Fortinet PSIRT FG-IR-26-196: fixed versions per line; FortiRecorder/FortiVoice fixes still 'upcoming'; no workaround or virtual patch listed; Known Exploited: No. X/search not used.","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-196"]}],"documents":[{"id":129730,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-196","title":"Fortinet PSIRT FG-IR-26-196","kind":"advisory","source":"analyst","publisher":null,"text":"FortiMail, FortiRecorder, FortiVoice OS command injection CWE-78, authenticated, crafted HTTP requests. Component API. Known exploited: No. CVSS 8.8. Fixes: FortiMail 8.0.2, 7.6.5, 7.4.7, 7.2 migrate; FortiRecorder upcoming 7.6.3/7.2.13/7.0.7; FortiVoice upcoming 8.0.2/7.4.3/7.2.6/7.0.9. Virtual patch: No.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}