---
id: "CVE-2026-126144"
page: "https://infrastack.ai/live/CVE-2026-126144"
kind: "vulnerability"
aliases: ["CVE-2026-126144"]
title: "Fortinet FortiMail, FortiRecorder, FortiVoice: authenticated OS command injection via crafted HTTP requests"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "FortiMail", "fixed": ["8.0.2"], "affected": ">= 8.0.0, <= 8.0.1", "ecosystem": "vendor"}, {"name": "FortiMail 7.6", "fixed": ["7.6.5"], "affected": ">= 7.6.0, <= 7.6.4", "ecosystem": "vendor"}, {"name": "FortiMail 7.4", "fixed": ["7.4.7"], "affected": ">= 7.4.0, <= 7.4.6", "ecosystem": "vendor"}, {"name": "FortiMail 7.2", "fixed": [], "affected": ">= 7.2.0, < 7.3.0", "ecosystem": "vendor"}, {"name": "FortiRecorder", "fixed": ["7.6.3"], "affected": ">= 7.6.0, <= 7.6.2", "ecosystem": "vendor"}, {"name": "FortiRecorder 7.2", "fixed": ["7.2.13"], "affected": ">= 7.2.0, <= 7.2.12", "ecosystem": "vendor"}, {"name": "FortiRecorder 7.0", "fixed": ["7.0.7"], "affected": ">= 7.0.0, <= 7.0.6", "ecosystem": "vendor"}, {"name": "FortiVoice", "fixed": ["8.0.2"], "affected": ">= 8.0.0, <= 8.0.1", "ecosystem": "vendor"}, {"name": "FortiVoice 7.4", "fixed": ["7.4.3"], "affected": ">= 7.4.0, <= 7.4.2", "ecosystem": "vendor"}, {"name": "FortiVoice 7.2", "fixed": ["7.2.6"], "affected": ">= 7.2.0, <= 7.2.5", "ecosystem": "vendor"}, {"name": "FortiVoice 7.0", "fixed": ["7.0.9"], "affected": ">= 7.0.0, <= 7.0.8", "ecosystem": "vendor"}]
ecosystems: []
tags: ["appliance", "authenticated", "fortimail", "fortinet", "fortirecorder", "fortivoice", "infrastructure"]
not_affected_if: ["unaffected-version"]
published_at: "2026-11-11T22:17:11+00:00"
first_seen_at: "2026-11-11T22:29:27+00:00"
updated_at: "2026-11-11T22:49:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126144", "first_seen_at": "2026-11-11T22:29:27+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-196", "first_seen_at": "2026-11-11T22:49:37+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-196"]}]
exploit_sources: []
---

# Fortinet FortiMail, FortiRecorder, FortiVoice: authenticated OS command injection via crafted HTTP requests

Link for people: https://infrastack.ai/live/CVE-2026-126144 (this .md is for agents)

Several Fortinet email security, call recording and voice products have an OS command injection flaw in their web interface. An attacker with a valid login can run unauthorized commands on the appliance by sending crafted HTTP requests.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiMail affected >= 8.0.0, <= 8.0.1 fixed 8.0.2
- vendor:FortiMail 7.6 affected >= 7.6.0, <= 7.6.4 fixed 7.6.5
- vendor:FortiMail 7.4 affected >= 7.4.0, <= 7.4.6 fixed 7.4.7
- vendor:FortiMail 7.2 affected >= 7.2.0, < 7.3.0 fixed no fixed version listed
- vendor:FortiRecorder affected >= 7.6.0, <= 7.6.2 fixed 7.6.3
- vendor:FortiRecorder 7.2 affected >= 7.2.0, <= 7.2.12 fixed 7.2.13
- vendor:FortiRecorder 7.0 affected >= 7.0.0, <= 7.0.6 fixed 7.0.7
- vendor:FortiVoice affected >= 8.0.0, <= 8.0.1 fixed 8.0.2
- vendor:FortiVoice 7.4 affected >= 7.4.0, <= 7.4.2 fixed 7.4.3
- vendor:FortiVoice 7.2 affected >= 7.2.0, <= 7.2.5 fixed 7.2.6
- vendor:FortiVoice 7.0 affected >= 7.0.0, <= 7.0.8 fixed 7.0.9

## How to check

Check the firmware version (CLI: get system status, or the web UI dashboard) against the affected ranges: FortiMail 8.0.0-8.0.1, 7.6.0-7.6.4, 7.4.0-7.4.6, all 7.2; FortiRecorder 7.6.0-7.6.2, 7.2.0-7.2.12, 7.0.0-7.0.6; FortiVoice 8.0.0-8.0.1, 7.4.0-7.4.2, 7.2.0-7.2.5, 7.0.0-7.0.8. Exploitation needs a valid login, so also restrict who can reach the admin/web interface.

## Fix

FortiMail: upgrade to 8.0.2, 7.6.5 or 7.4.7 (7.2 has no fix in the 7.2 branch: migrate to a fixed release). FortiRecorder and FortiVoice fixes are listed as upcoming, not yet released: FortiRecorder 7.6.3, 7.2.13, 7.0.7; FortiVoice 8.0.2, 7.4.3, 7.2.6, 7.0.9. Fortinet lists no workaround and no virtual patch.

## Timeline

- 2026-11-11T22:29:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126144
- 2026-11-11T22:49:37+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-196 — Read Fortinet PSIRT FG-IR-26-196: fixed versions per line; FortiRecorder/FortiVoice fixes still 'upcoming'; no workaround or virtual patch listed; Known Exploited: No. X/search not used.

## Documents

- [advisory] Fortinet PSIRT FG-IR-26-196 https://fortiguard.fortinet.com/psirt/FG-IR-26-196

## From the sources

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.4, FortiMail 7.4.0 through 7.4.6, FortiMail 7.2 all versions, FortiRecorder 7.6.0 through 7.6.2, FortiRecorder 7.2.0 through 7.2.12, FortiRecorder 7.0.0 through 7.0.6, FortiVoice 8.0.0 through 8.0.1, FortiVoice 7.4.0 through 7.4.2, FortiVoice 7.2.0 through 7.2.5, FortiVoice 7.0.0 through 7.0.8 may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_