---
id: "CVE-2026-126148"
page: "https://infrastack.ai/live/CVE-2026-126148"
kind: "vulnerability"
aliases: ["CVE-2026-126148"]
title: "Fortinet FortiMail: crafted HA packets let unauthenticated attackers run commands"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "FortiMail", "fixed": ["7.6.7"], "affected": ">= 7.6.0, <= 7.6.6", "ecosystem": "vendor"}, {"name": "FortiMail 8.0", "fixed": ["8.0.2"], "affected": ">= 8.0.0, <= 8.0.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["email-gateway", "fortimail", "fortinet", "infrastructure", "self-hosted"]
not_affected_if: ["fortimail-cloud", "managed-hosting", "unknown"]
published_at: "2026-11-11T22:17:12+00:00"
first_seen_at: "2026-11-11T22:29:27+00:00"
updated_at: "2026-11-11T22:33:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126148", "first_seen_at": "2026-11-11T22:29:27+00:00"}, {"source": "analyst", "url": "https://www.fortiguard.com/psirt/FG-IR-26-200", "first_seen_at": "2026-11-11T22:33:21+00:00", "cites": ["https://www.fortiguard.com/psirt/FG-IR-26-200"]}]
exploit_sources: []
---

# Fortinet FortiMail: crafted HA packets let unauthenticated attackers run commands

Link for people: https://infrastack.ai/live/CVE-2026-126148 (this .md is for agents)

FortiMail 8.0.0 through 8.0.1 and 7.6.0 through 7.6.6 contain an OS command injection flaw in the high-availability join-request handling. An unauthenticated attacker who sends crafted HA join-request packets can execute unauthorized code or commands on the appliance.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiMail affected >= 7.6.0, <= 7.6.6 fixed 7.6.7
- vendor:FortiMail 8.0 affected >= 8.0.0, <= 8.0.1 fixed 8.0.2

## How to check

Check the FortiMail firmware version (admin GUI or CLI 'get system status'). Exposed if on 8.0.0-8.0.1 or 7.6.0-7.6.6 (self-managed). FortiMail 7.4 and 7.2 are listed as not affected. Fortinet's advisory does not say whether HA must be configured for the flaw to be reachable, so treat every affected-version appliance as exposed, and prioritise those with HA enabled or with the HA port reachable from untrusted networks.

## Fix

FortiMail 8.0.x: upgrade to 8.0.2 or above. FortiMail 7.6.x: upgrade to 7.6.7 or above. Fortinet lists no virtual patch. FortiMail Cloud was updated by Fortinet on Oct 5, 2026 (no customer action).

## Timeline

- 2026-11-11T22:29:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126148
- 2026-11-11T22:33:21+00:00 analyst https://www.fortiguard.com/psirt/FG-IR-26-200 — Read Fortinet FG-IR-26-200 (primary). Fix 8.0.2 / 7.6.7; 7.4 and 7.2 not affected; FortiMail Cloud already patched Oct 5. Advisory does not say HA must be enabled; X/discussion not searched (not needed, no exploitation reported, Known Exploited No per Fortinet via Rescana).

## Documents

- [advisory] Fortinet FG-IR-26-200 FortiMail command injection https://www.fortiguard.com/psirt/FG-IR-26-200

## From the sources

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted HA join-request packets.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_