{"id":"CVE-2026-126146","kind":"vulnerability","aliases":["CVE-2026-126146"],"related":[],"title":"Fortinet FortiMail and FortiRecorder: authenticated admins can run OS commands","description":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.4, FortiMail 7.4.0 through 7.4.6, FortiMail 7.2.0 through 7.2.9, FortiRecorder 7.6.0, FortiRecorder 7.2.0 through 7.2.11, FortiRecorder 7.0.0 through 7.0.6 may allow an authenticated privileged attacker to execute unauthorized code or commands via a specifically crafted archive account configuration.","summary":"Fortinet FortiMail 7.2 through 8.0.1 and FortiRecorder 7.0 through 7.6.0 let an authenticated privileged user run unauthorized OS commands through a crafted archive account configuration. An attacker who already holds a privileged login can execute code on the appliance.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiMail","fixed":["7.2.10"],"affected":">= 7.2.0, <= 7.2.9","ecosystem":"vendor"},{"name":"FortiMail","fixed":["7.4.7"],"affected":">= 7.4.0, <= 7.4.6","ecosystem":"vendor"},{"name":"FortiMail","fixed":["7.6.5"],"affected":">= 7.6.0, <= 7.6.4","ecosystem":"vendor"},{"name":"FortiMail","fixed":["8.0.2"],"affected":">= 8.0.0, <= 8.0.1","ecosystem":"vendor"},{"name":"FortiRecorder","fixed":["7.6.3"],"affected":"7.6.0","ecosystem":"vendor"},{"name":"FortiRecorder","fixed":["7.2.13"],"affected":">= 7.2.0, <= 7.2.11","ecosystem":"vendor"},{"name":"FortiRecorder","fixed":["7.0.7"],"affected":">= 7.0.0, <= 7.0.6","ecosystem":"vendor"}],"ecosystems":[],"tags":["auth-required","fortimail","fortinet","fortirecorder","self-hosted","vendor"],"not_affected_if":["auth-required","no-privileged-accounts-exposed","unaffected-version"],"how_to_check":"Check the running version (FortiMail or FortiRecorder CLI: get system status; or the web UI dashboard) against FG-IR-26-198. FortiMail affected: 8.0.0-8.0.1, 7.6.0-7.6.4, 7.4.0-7.4.6, 7.2.0-7.2.9. FortiRecorder affected: 7.6.0, 7.2.0-7.2.11, 7.0.0-7.0.6. Then review which accounts hold privileged admin roles and whether the admin interface is reachable from untrusted networks. Fortinet lists no workaround.","fix":"FortiMail: 8.0.2, 7.6.5, 7.4.7 or later. 7.2.10 is listed as upcoming. FortiRecorder: 7.6.3, 7.2.13, 7.0.7, all listed as upcoming by Fortinet on 2026-11-10.","status":"open","published_at":"2026-11-11T22:17:11+00:00","first_seen_at":"2026-11-11T22:29:27+00:00","triaged_at":"2026-11-11T22:33:52+00:00","updated_at":"2026-11-11T22:49:39+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-11T22:33:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Fortinet FortiMail and FortiRecorder: authenticated admins can run OS commands","impact":"high","summary":"Fortinet FortiMail 7.2 through 8.0.1 and FortiRecorder 7.0 through 7.6.0 let an authenticated privileged user run unauthorized OS commands through a crafted archive account configuration. An attacker who already holds a privileged login can execute code on the appliance.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortimail","fortirecorder","fortinet","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Privileged attacker runs arbitrary OS commands on the appliance.","analyst_note":"Check the Fortinet PSIRT advisory for fixed versions and any workaround for CVE-2026-126146; the sources here give none.","how_to_check":"- Check the running FortiMail or FortiRecorder version against the affected ranges in the description: FortiMail `8.0.0` to `8.0.1`, `7.6.0` to `7.6.4`, `7.4.0` to `7.4.6`, `7.2.0` to `7.2.9`; FortiRecorder `7.6.0`, `7.2.0` to `7.2.11`, `7.0.0` to `7.0.6`.\n- Review which accounts hold privileged administrator roles on the appliance.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unaffected-version","no-privileged-accounts-exposed"],"who_is_affected":"Teams running affected FortiMail or FortiRecorder appliances in the listed version ranges. The attacker needs an authenticated privileged account, so exposure depends on who holds admin access. Sources do not say whether a default configuration is affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000805,"input_tokens":4658,"output_tokens":678,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Fortinet PSIRT advisory for fixed versions and any workaround for CVE-2026-126146; the sources here give none.","search":"'-126146':13A,16A '-2026':12A,15A '7.0':41B '7.0.0':113C '7.0.6':115C '7.2':36B '7.2.0':103C,109C '7.2.11':111C '7.2.9':105C '7.4.0':99C '7.4.6':101C '7.6.0':43B,95C,107C '7.6.4':97C '8.0.0':91C '8.0.1':38B,93C 'account':57B,133C 'admin':6A 'allow':117C 'alreadi':62B 'applianc':72B 'archiv':56B,132C 'attack':60B,121C 'auth':25B 'auth-requir':24B 'authent':5A,46B,119C 'code':69B,125C 'command':10A,52B,83C,85C,127C 'configur':58B,134C 'craft':55B,131C 'cve':11A,14A 'element':78C 'execut':68B,123C 'fortimail':2A,17A,18A,19A,20A,27B,35B,90C,94C,98C,102C 'fortinet':1A,28B,34B,89C 'fortirecord':4A,29B,40B,106C,108C,112C 'fortirecorder':21A,22A,23A 'hold':63B 'host':32B 'improp':74C 'inject':86C 'let':44B 'login':66B 'may':116C 'neutral':75C 'os':9A,51B,82C,84C 'privileg':47B,65B,120C 'requir':26B 'run':8A,49B 'self':31B 'self-host':30B 'special':77C 'specif':130C 'unauthor':50B,124C 'use':79C 'user':48B 'vendor':33B 'via':128C 'vulner':87C","nicknames":[],"mitigations":[],"who_affected":"Teams that run self-hosted FortiMail (mail gateway) or FortiRecorder (video recorder) appliances in the affected versions. An attacker needs a privileged admin login, then sends a crafted archive account configuration to run OS commands. The risk is highest where admin credentials are shared, weak, or the management interface is exposed. Fortinet-hosted or non-Fortinet mail and video systems can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:49:39Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-198","run_id":3667},"products":{"at":"2026-11-11T22:49:39Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-198","run_id":3667},"how_to_check":{"at":"2026-11-11T22:49:39Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-198","run_id":3667},"who_affected":{"at":"2026-11-11T22:49:39Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-198","run_id":3667}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["fortimail","fortirecorder"],"ptokens":["fortimail","fortirecorder"],"labels":["authrequired","fortimail","fortinet","fortirecorder","high","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126146':13A,16A '-2026':12A,15A 'admin':6A 'authent':5A 'command':10A 'cve':11A,14A 'fortimail':2A,17A,18A,19A,20A 'fortinet':1A 'fortirecord':4A 'fortirecorder':21A,22A,23A 'os':9A 'run':8A","search_b":"'7.0':41B '7.2':36B '7.6.0':43B '8.0.1':38B 'account':57B 'alreadi':62B 'applianc':72B 'archiv':56B 'attack':60B 'auth':25B 'auth-requir':24B 'authent':46B 'code':69B 'command':52B 'configur':58B 'craft':55B 'execut':68B 'fortimail':27B,35B 'fortinet':28B,34B 'fortirecord':29B,40B 'hold':63B 'host':32B 'let':44B 'login':66B 'os':51B 'privileg':47B,65B 'requir':26B 'run':49B 'self':31B 'self-host':30B 'unauthor':50B 'user':48B 'vendor':33B","search_c":"'7.0.0':113C '7.0.6':115C '7.2.0':103C,109C '7.2.11':111C '7.2.9':105C '7.4.0':99C '7.4.6':101C '7.6.0':95C,107C '7.6.4':97C '8.0.0':91C '8.0.1':93C 'account':133C 'allow':117C 'archiv':132C 'attack':121C 'authent':119C 'code':125C 'command':83C,85C,127C 'configur':134C 'craft':131C 'element':78C 'execut':123C 'fortimail':90C,94C,98C,102C 'fortinet':89C 'fortirecord':106C,108C,112C 'improp':74C 'inject':86C 'may':116C 'neutral':75C 'os':82C,84C 'privileg':120C 'special':77C 'specif':130C 'unauthor':124C 'use':79C 'via':128C 'vulner':87C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126146","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126146","severity":null,"published_at":"2026-11-11T22:17:11+00:00","modified_at":"2026-11-11T22:17:11+00:00","first_seen_at":"2026-11-11T22:29:27+00:00","fetched_at":"2026-11-11T22:29:27+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126146:3667","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-198","severity":null,"published_at":"2026-11-11T22:49:39+00:00","modified_at":"2026-11-11T22:49:39+00:00","first_seen_at":"2026-11-11T22:49:39+00:00","fetched_at":"2026-11-11T22:49:39+00:00","note":"Read Fortinet FG-IR-26-198 (vendor). Fixed FortiMail 7.4.7/7.6.5/8.0.2 out; 7.2.10 and all FortiRecorder fixes marked upcoming. No workaround, no virtual patch, no exploitation seen. X/social not checked.","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-198"]}],"documents":[{"id":129731,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-198","title":"Fortinet FG-IR-26-198","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}