{"id":"CVE-2026-126148","kind":"vulnerability","aliases":["CVE-2026-126148"],"related":[],"title":"Fortinet FortiMail: crafted HA packets let unauthenticated attackers run commands","description":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted HA join-request packets.","summary":"FortiMail 8.0.0 through 8.0.1 and 7.6.0 through 7.6.6 contain an OS command injection flaw in the high-availability join-request handling. An unauthenticated attacker who sends crafted HA join-request packets can execute unauthorized code or commands on the appliance.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiMail","fixed":["7.6.7"],"affected":">= 7.6.0, <= 7.6.6","ecosystem":"vendor"},{"name":"FortiMail 8.0","fixed":["8.0.2"],"affected":">= 8.0.0, <= 8.0.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["email-gateway","fortimail","fortinet","infrastructure","self-hosted"],"not_affected_if":["fortimail-cloud","managed-hosting","unknown"],"how_to_check":"Check the FortiMail firmware version (admin GUI or CLI 'get system status'). Exposed if on 8.0.0-8.0.1 or 7.6.0-7.6.6 (self-managed). FortiMail 7.4 and 7.2 are listed as not affected. Fortinet's advisory does not say whether HA must be configured for the flaw to be reachable, so treat every affected-version appliance as exposed, and prioritise those with HA enabled or with the HA port reachable from untrusted networks.","fix":"FortiMail 8.0.x: upgrade to 8.0.2 or above. FortiMail 7.6.x: upgrade to 7.6.7 or above. Fortinet lists no virtual patch. FortiMail Cloud was updated by Fortinet on Oct 5, 2026 (no customer action).","status":"open","published_at":"2026-11-11T22:17:12+00:00","first_seen_at":"2026-11-11T22:29:27+00:00","triaged_at":"2026-11-11T22:31:00+00:00","updated_at":"2026-11-11T22:33:21+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-11T22:31:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Fortinet FortiMail: crafted HA packets let unauthenticated attackers run commands","impact":"high","summary":"FortiMail 8.0.0 through 8.0.1 and 7.6.0 through 7.6.6 contain an OS command injection flaw in the high-availability join-request handling. An unauthenticated attacker who sends crafted HA join-request packets can execute unauthorized code or commands on the appliance.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortimail","email-gateway","fortinet"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated attacker runs arbitrary commands on the appliance","analyst_note":"Confirm the fixed FortiMail versions and whether HA clustering must be enabled for exposure, using the Fortinet advisory for CVE-2026-126148.","how_to_check":"- Check the FortiMail firmware version in the admin interface and compare it to the affected ranges `8.0.0` to `8.0.1` and `7.6.0` to `7.6.6`.\n- Check whether high-availability clustering is configured on the appliance.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"FortiMail appliances in the affected version ranges are exposed to the flaw as described in the description. The sources do not say whether the HA feature must be enabled for exposure, so teams without HA clustering should still verify. unknown beyond that.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000744,"input_tokens":4557,"output_tokens":577,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed FortiMail versions and whether HA clustering must be enabled for exposure, using the Fortinet advisory for CVE-2026-126148.","search":"'-126148':13A,16A '-2026':12A,15A '7.6.0':34B,94C '7.6.6':36B,96C '8.0':19A '8.0.0':30B,90C '8.0.1':32B,92C 'allow':98C 'applianc':71B 'attack':8A,54B,101C 'avail':47B 'code':66B,105C 'command':10A,40B,68B,82C,84C,107C 'contain':37B 'craft':3A,57B,109C 'cve':11A,14A 'element':77C 'email':21B 'email-gateway':20B 'execut':64B,103C 'flaw':42B 'fortimail':2A,17A,18A,23B,29B,89C,93C 'fortinet':1A,24B,88C 'gateway':22B 'ha':4A,58B,110C 'handl':51B 'high':46B 'high-avail':45B 'host':28B 'improp':73C 'infrastructur':25B 'inject':41B,85C 'join':49B,60B,112C 'join-request':48B,59B,111C 'let':6A 'may':97C 'neutral':74C 'os':39B,81C,83C 'packet':5A,62B,114C 'request':50B,61B,113C 'run':9A 'self':27B 'self-host':26B 'send':56B 'special':76C 'unauthent':7A,53B,100C 'unauthor':65B,104C 'use':78C 'via':108C 'vulner':86C","nicknames":[],"mitigations":[],"who_affected":"Self-managed FortiMail appliances and VMs running 8.0.0-8.0.1 or 7.6.0-7.6.6 are affected: crafted HA join-request packets can let an unauthenticated attacker run commands. Fortinet's advisory does not say HA clustering must be enabled, so do not assume single units are safe. FortiMail 7.4/7.2 and FortiMail Cloud (already patched by Fortinet) can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:33:21Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-200","run_id":3609},"products":{"at":"2026-11-11T22:33:21Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-200","run_id":3609},"who_affected":{"at":"2026-11-11T22:33:21Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-200","run_id":3609}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["80","fortimail","fortimail80"],"ptokens":["fortimail"],"labels":["critical","emailgateway","fortimail","fortinet","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-126148':13A,16A '-2026':12A,15A '8.0':19A 'attack':8A 'command':10A 'craft':3A 'cve':11A,14A 'fortimail':2A,17A,18A 'fortinet':1A 'ha':4A 'let':6A 'packet':5A 'run':9A 'unauthent':7A","search_b":"'7.6.0':34B '7.6.6':36B '8.0.0':30B '8.0.1':32B 'applianc':71B 'attack':54B 'avail':47B 'code':66B 'command':40B,68B 'contain':37B 'craft':57B 'email':21B 'email-gateway':20B 'execut':64B 'flaw':42B 'fortimail':23B,29B 'fortinet':24B 'gateway':22B 'ha':58B 'handl':51B 'high':46B 'high-avail':45B 'host':28B 'infrastructur':25B 'inject':41B 'join':49B,60B 'join-request':48B,59B 'os':39B 'packet':62B 'request':50B,61B 'self':27B 'self-host':26B 'send':56B 'unauthent':53B 'unauthor':65B","search_c":"'7.6.0':94C '7.6.6':96C '8.0.0':90C '8.0.1':92C 'allow':98C 'attack':101C 'code':105C 'command':82C,84C,107C 'craft':109C 'element':77C 'execut':103C 'fortimail':89C,93C 'fortinet':88C 'ha':110C 'improp':73C 'inject':85C 'join':112C 'join-request':111C 'may':97C 'neutral':74C 'os':81C,83C 'packet':114C 'request':113C 'special':76C 'unauthent':100C 'unauthor':104C 'use':78C 'via':108C 'vulner':86C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126148","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126148","severity":null,"published_at":"2026-11-11T22:17:12+00:00","modified_at":"2026-11-11T22:17:12+00:00","first_seen_at":"2026-11-11T22:29:27+00:00","fetched_at":"2026-11-11T22:29:27+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126148:3609","url":"https://www.fortiguard.com/psirt/FG-IR-26-200","severity":null,"published_at":"2026-11-11T22:33:21+00:00","modified_at":"2026-11-11T22:33:21+00:00","first_seen_at":"2026-11-11T22:33:21+00:00","fetched_at":"2026-11-11T22:33:21+00:00","note":"Read Fortinet FG-IR-26-200 (primary). Fix 8.0.2 / 7.6.7; 7.4 and 7.2 not affected; FortiMail Cloud already patched Oct 5. Advisory does not say HA must be enabled; X/discussion not searched (not needed, no exploitation reported, Known Exploited No per Fortinet via Rescana).","cites":["https://www.fortiguard.com/psirt/FG-IR-26-200"]}],"documents":[{"id":129645,"url":"https://www.fortiguard.com/psirt/FG-IR-26-200","title":"Fortinet FG-IR-26-200 FortiMail command injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}