CVE-2026-126146 · Vendor
NO FIX YET
Fortinet FortiMail 7.2 through 8.0.1 and FortiRecorder 7.0 through 7.6.0 let an authenticated privileged user run unauthorized OS commands through a crafted archive account configuration. An attacker who already holds a privileged login can execute code on the appliance.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running affected FortiMail or FortiRecorder appliances in the listed version ranges. The attacker needs an authenticated privileged account, so exposure depends on who holds admin access. Sources do not say whether a default configuration is affected.
Not affected if no-privileged-accounts-exposed, unaffected-version
Who cares fortimail, fortinet, fortirecorder, self-hosted
8.0.0 to 8.0.1, 7.6.0 to 7.6.4, 7.4.0 to 7.4.6, 7.2.0 to 7.2.9; FortiRecorder 7.6.0, 7.2.0 to 7.2.11, to .A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.4, FortiMail 7.4.0 through 7.4.6, FortiMail 7.2.0 through 7.2.9, FortiRecorder 7.6.0, FortiRecorder 7.2.0 through 7.2.11, FortiRecorder 7.0.0 through 7.0.6 may allow an authenticated privileged attacker to execute unauthorized code or commands via a specifically crafted archive account configuration.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
7.0.07.0.6No fix yet, per the sources.