{"id":"CVE-2026-126145","kind":"vulnerability","aliases":["CVE-2026-126145"],"related":[],"title":"Fortinet FortiMail: admin with system-time access can run commands as root","description":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated administrator with system-time read-write access to execute unauthorized code or commands as root.","summary":"An authenticated FortiMail administrator who holds system-time read-write access can inject OS commands and run them as root. The flaw affects FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all 7.2 versions.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["email-gateway","fortimail","fortinet","vendor"],"not_affected_if":["no-system-time-admin","unaffected-version"],"how_to_check":"- Check the FortiMail version under System > Status or with `get system status` in the CLI, and compare it with the affected ranges.\n- Review which administrator accounts hold system-time read-write access.","fix":"- Fixed versions are not stated in the sources; check the Fortinet advisory for the fixed release in each branch.","status":"open","published_at":"2026-11-11T22:17:11+00:00","first_seen_at":"2026-11-11T22:29:27+00:00","triaged_at":"2026-11-11T22:33:53+00:00","updated_at":"2026-11-11T22:33:53+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-11T22:33:53Z","model":"claude-haiku-5-5","output":{"fix":"- Fixed versions are not stated in the sources; check the Fortinet advisory for the fixed release in each branch.","reach":"network","title":"Fortinet FortiMail: admin with system-time access can run commands as root","impact":"high","summary":"An authenticated FortiMail administrator who holds system-time read-write access can inject OS commands and run them as root. The flaw affects FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all 7.2 versions.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortimail","email-gateway","fortinet"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs arbitrary commands as root on the appliance.","analyst_note":"Find the Fortinet PSIRT advisory for the fixed versions per branch and confirm the 7.2 fixed release; the sources give no fix.","how_to_check":"- Check the FortiMail version under System > Status or with `get system status` in the CLI, and compare it with the affected ranges.\n- Review which administrator accounts hold system-time read-write access.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unaffected-version","no-system-time-admin"],"who_is_affected":"Organisations running affected FortiMail versions where an administrator has system-time read-write access. The attacker must already be authenticated as an administrator, so exposure depends on who holds that role. Installations on unaffected versions can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000758,"input_tokens":4586,"output_tokens":599,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126145':16A,19A '-2026':15A,18A '7.2':63B,95C '7.4.0':58B,91C '7.4.8':60B,93C '7.6.0':55B,87C '7.6.6':57B,89C '8.0.0':52B,83C '8.0.1':54B,85C 'access':8A,38B,110C 'admin':3A 'administr':29B,102C 'affect':50B 'allow':99C 'authent':27B,101C 'code':114C 'command':11A,42B,75C,77C,116C 'cve':14A,17A 'element':70C 'email':21B 'email-gateway':20B 'execut':112C 'flaw':49B 'fortimail':2A,23B,28B,51B,82C,86C,90C,94C 'fortinet':1A,24B,81C 'gateway':22B 'hold':31B 'improp':66C 'inject':40B,78C 'may':98C 'neutral':67C 'os':41B,74C,76C 'read':36B,108C 'read-writ':35B,107C 'root':13A,47B,118C 'run':10A,44B 'special':69C 'system':6A,33B,105C 'system-tim':5A,32B,104C 'time':7A,34B,106C 'unauthor':113C 'use':71C 'vendor':25B 'version':64B,97C 'vulner':79C 'write':37B,109C","nicknames":[],"mitigations":[],"who_affected":"Organisations running affected FortiMail versions where an administrator has system-time read-write access. The attacker must already be authenticated as an administrator, so exposure depends on who holds that role. Installations on unaffected versions can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["emailgateway","fortimail","fortinet","high","vendor"],"campaign_type":null,"search_a":"'-126145':16A,19A '-2026':15A,18A 'access':8A 'admin':3A 'command':11A 'cve':14A,17A 'fortimail':2A 'fortinet':1A 'root':13A 'run':10A 'system':6A 'system-tim':5A 'time':7A","search_b":"'7.2':63B '7.4.0':58B '7.4.8':60B '7.6.0':55B '7.6.6':57B '8.0.0':52B '8.0.1':54B 'access':38B 'administr':29B 'affect':50B 'authent':27B 'command':42B 'email':21B 'email-gateway':20B 'flaw':49B 'fortimail':23B,28B,51B 'fortinet':24B 'gateway':22B 'hold':31B 'inject':40B 'os':41B 'read':36B 'read-writ':35B 'root':47B 'run':44B 'system':33B 'system-tim':32B 'time':34B 'vendor':25B 'version':64B 'write':37B","search_c":"'7.2':95C '7.4.0':91C '7.4.8':93C '7.6.0':87C '7.6.6':89C '8.0.0':83C '8.0.1':85C 'access':110C 'administr':102C 'allow':99C 'authent':101C 'code':114C 'command':75C,77C,116C 'element':70C 'execut':112C 'fortimail':82C,86C,90C,94C 'fortinet':81C 'improp':66C 'inject':78C 'may':98C 'neutral':67C 'os':74C,76C 'read':108C 'read-writ':107C 'root':118C 'special':69C 'system':105C 'system-tim':104C 'time':106C 'unauthor':113C 'use':71C 'version':97C 'vulner':79C 'write':109C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126145","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126145","severity":null,"published_at":"2026-11-11T22:17:11+00:00","modified_at":"2026-11-11T22:17:11+00:00","first_seen_at":"2026-11-11T22:29:27+00:00","fetched_at":"2026-11-11T22:29:27+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}