---
id: "CVE-2026-126146"
page: "https://infrastack.ai/live/CVE-2026-126146"
kind: "vulnerability"
aliases: ["CVE-2026-126146"]
title: "Fortinet FortiMail and FortiRecorder: authenticated admins can run OS commands"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "FortiMail", "fixed": ["7.2.10"], "affected": ">= 7.2.0, <= 7.2.9", "ecosystem": "vendor"}, {"name": "FortiMail", "fixed": ["7.4.7"], "affected": ">= 7.4.0, <= 7.4.6", "ecosystem": "vendor"}, {"name": "FortiMail", "fixed": ["7.6.5"], "affected": ">= 7.6.0, <= 7.6.4", "ecosystem": "vendor"}, {"name": "FortiMail", "fixed": ["8.0.2"], "affected": ">= 8.0.0, <= 8.0.1", "ecosystem": "vendor"}, {"name": "FortiRecorder", "fixed": ["7.6.3"], "affected": "7.6.0", "ecosystem": "vendor"}, {"name": "FortiRecorder", "fixed": ["7.2.13"], "affected": ">= 7.2.0, <= 7.2.11", "ecosystem": "vendor"}, {"name": "FortiRecorder", "fixed": ["7.0.7"], "affected": ">= 7.0.0, <= 7.0.6", "ecosystem": "vendor"}]
ecosystems: []
tags: ["auth-required", "fortimail", "fortinet", "fortirecorder", "self-hosted", "vendor"]
not_affected_if: ["auth-required", "no-privileged-accounts-exposed", "unaffected-version"]
published_at: "2026-11-11T22:17:11+00:00"
first_seen_at: "2026-11-11T22:29:27+00:00"
updated_at: "2026-11-11T22:49:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126146", "first_seen_at": "2026-11-11T22:29:27+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-198", "first_seen_at": "2026-11-11T22:49:39+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-198"]}]
exploit_sources: []
---

# Fortinet FortiMail and FortiRecorder: authenticated admins can run OS commands

Link for people: https://infrastack.ai/live/CVE-2026-126146 (this .md is for agents)

Fortinet FortiMail 7.2 through 8.0.1 and FortiRecorder 7.0 through 7.6.0 let an authenticated privileged user run unauthorized OS commands through a crafted archive account configuration. An attacker who already holds a privileged login can execute code on the appliance.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiMail affected >= 7.2.0, <= 7.2.9 fixed 7.2.10
- vendor:FortiMail affected >= 7.4.0, <= 7.4.6 fixed 7.4.7
- vendor:FortiMail affected >= 7.6.0, <= 7.6.4 fixed 7.6.5
- vendor:FortiMail affected >= 8.0.0, <= 8.0.1 fixed 8.0.2
- vendor:FortiRecorder affected 7.6.0 fixed 7.6.3
- vendor:FortiRecorder affected >= 7.2.0, <= 7.2.11 fixed 7.2.13
- vendor:FortiRecorder affected >= 7.0.0, <= 7.0.6 fixed 7.0.7

## How to check

Check the running version (FortiMail or FortiRecorder CLI: get system status; or the web UI dashboard) against FG-IR-26-198. FortiMail affected: 8.0.0-8.0.1, 7.6.0-7.6.4, 7.4.0-7.4.6, 7.2.0-7.2.9. FortiRecorder affected: 7.6.0, 7.2.0-7.2.11, 7.0.0-7.0.6. Then review which accounts hold privileged admin roles and whether the admin interface is reachable from untrusted networks. Fortinet lists no workaround.

## Fix

FortiMail: 8.0.2, 7.6.5, 7.4.7 or later. 7.2.10 is listed as upcoming. FortiRecorder: 7.6.3, 7.2.13, 7.0.7, all listed as upcoming by Fortinet on 2026-11-10.

## Timeline

- 2026-11-11T22:29:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126146
- 2026-11-11T22:49:39+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-198 — Read Fortinet FG-IR-26-198 (vendor). Fixed FortiMail 7.4.7/7.6.5/8.0.2 out; 7.2.10 and all FortiRecorder fixes marked upcoming. No workaround, no virtual patch, no exploitation seen. X/social not checked.

## Documents

- [advisory] Fortinet FG-IR-26-198 https://fortiguard.fortinet.com/psirt/FG-IR-26-198

## From the sources

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.4, FortiMail 7.4.0 through 7.4.6, FortiMail 7.2.0 through 7.2.9, FortiRecorder 7.6.0, FortiRecorder 7.2.0 through 7.2.11, FortiRecorder 7.0.0 through 7.0.6 may allow an authenticated privileged attacker to execute unauthorized code or commands via a specifically crafted archive account configuration.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_