{"id":"CVE-2026-126153","kind":"vulnerability","aliases":["CVE-2026-126153"],"related":[],"title":"FortiMail: path traversal in the API lets unauthenticated attackers run commands (fixed in 8.0.2, 7.6.7, 7.4.9)","description":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to execute unauthorized commands via crafted requests.","summary":"A path traversal flaw in Fortinet FortiMail lets an attacker escape a restricted directory using crafted requests. According to the description, an unauthenticated attacker may be able to execute unauthorized commands.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiMail","fixed":["8.0.2"],"affected":">= 8.0.0, <= 8.0.1","ecosystem":"vendor"},{"name":"FortiMail","fixed":["7.6.7"],"affected":">= 7.6.0, <= 7.6.6","ecosystem":"vendor"},{"name":"FortiMail","fixed":["7.4.9"],"affected":">= 7.4.0, <= 7.4.8","ecosystem":"vendor"}],"ecosystems":[],"tags":["email-gateway","fortimail","fortinet","self-hosted","unauthenticated","vendor"],"not_affected_if":["fortimail-cloud","managed-hosting","unaffected-version"],"how_to_check":"Check the FortiMail firmware version (admin GUI dashboard or CLI 'get system status'). Exposed if it is 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, or any 7.2. FortiMail Cloud customers need no action. Fortinet lists no virtual patch and no workaround.","fix":"Upgrade FortiMail 8.0 to 8.0.2 or above, 7.6 to 7.6.7 or above, 7.4 to 7.4.9 or above. 7.2 has no fixed release: migrate to a fixed branch. FortiMail Cloud was already updated on Oct 05, 2026.","status":"open","published_at":"2026-11-11T22:17:13+00:00","first_seen_at":"2026-11-11T22:29:28+00:00","triaged_at":"2026-11-11T22:33:04+00:00","updated_at":"2026-11-11T22:48:39+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-11-11T22:33:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"FortiMail: path traversal lets unauthenticated attackers run unauthorized commands","impact":"high","summary":"A path traversal flaw in Fortinet FortiMail lets an attacker escape a restricted directory using crafted requests. According to the description, an unauthenticated attacker may be able to execute unauthorized commands.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortimail","email-gateway","fortinet"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs unauthorized commands on the mail appliance","analyst_note":"Check the Fortinet PSIRT advisory for FortiMail CVE-2026-126153 for the fixed versions, the exact conditions and whether the flaw is exploited; the NVD entry gives only the description.","how_to_check":"- Check the installed FortiMail version in the admin interface and compare it with the affected ranges: `8.0.0` through `8.0.1`, `7.6.0` through `7.6.6`, `7.4.0` through `7.4.8`, and all `7.2` versions.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Organisations running FortiMail in the affected version ranges, which are reachable by an attacker. The sources do not say which deployment settings are required, so exposure cannot be confirmed from them. Teams not running FortiMail can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00074,"input_tokens":4596,"output_tokens":560,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Fortinet PSIRT advisory for FortiMail CVE-2026-126153 for the fixed versions, the exact conditions and whether the flaw is exploited; the NVD entry gives only the description.","search":"'-126153':19A,22A '-2026':18A,21A '7.2':95C '7.4.0':91C '7.4.8':93C '7.4.9':16A '7.6.0':87C '7.6.6':89C '7.6.7':15A '8.0.0':83C '8.0.1':85C '8.0.2':14A 'abl':62B 'accord':53B 'allow':99C 'api':6A 'attack':9A,45B,59B,102C 'command':11A,66B,106C 'craft':51B,108C 'cve':17A,20A 'descript':56B 'directori':49B,76C 'email':27B 'email-gateway':26B 'escap':46B 'execut':64B,104C 'fix':12A 'flaw':39B 'fortimail':1A,23A,24A,25A,29B,42B,82C,86C,90C,94C 'fortinet':30B,41B,81C 'gateway':28B 'host':33B 'improp':68C 'let':7A,43B 'limit':69C 'may':60B,98C 'path':2A,37B,77C 'pathnam':72C 'request':52B,109C 'restrict':48B,75C 'run':10A 'self':32B 'self-host':31B 'travers':3A,38B,78C 'unauthent':8A,34B,58B,101C 'unauthor':65B,105C 'use':50B 'vendor':35B 'version':97C 'via':107C 'vulner':79C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted FortiMail appliances or VMs (email gateways) on the affected versions. An unauthenticated attacker sending crafted requests to the API may execute unauthorized code or commands. FortiMail Cloud customers can skip it; Fortinet updated all firmware on Oct 05, 2026.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:48:39Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-205","run_id":3664},"products":{"at":"2026-11-11T22:48:39Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-205","run_id":3664},"how_to_check":{"at":"2026-11-11T22:48:39Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-205","run_id":3664},"who_affected":{"at":"2026-11-11T22:48:39Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-205","run_id":3664}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["fortimail"],"ptokens":["fortimail"],"labels":["emailgateway","fortimail","fortinet","high","selfhosted","unauthenticated","vendor"],"campaign_type":null,"search_a":"'-126153':19A,22A '-2026':18A,21A '7.4.9':16A '7.6.7':15A '8.0.2':14A 'api':6A 'attack':9A 'command':11A 'cve':17A,20A 'fix':12A 'fortimail':1A,23A,24A,25A 'let':7A 'path':2A 'run':10A 'travers':3A 'unauthent':8A","search_b":"'abl':62B 'accord':53B 'attack':45B,59B 'command':66B 'craft':51B 'descript':56B 'directori':49B 'email':27B 'email-gateway':26B 'escap':46B 'execut':64B 'flaw':39B 'fortimail':29B,42B 'fortinet':30B,41B 'gateway':28B 'host':33B 'let':43B 'may':60B 'path':37B 'request':52B 'restrict':48B 'self':32B 'self-host':31B 'travers':38B 'unauthent':34B,58B 'unauthor':65B 'use':50B 'vendor':35B","search_c":"'7.2':95C '7.4.0':91C '7.4.8':93C '7.6.0':87C '7.6.6':89C '8.0.0':83C '8.0.1':85C 'allow':99C 'attack':102C 'command':106C 'craft':108C 'directori':76C 'execut':104C 'fortimail':82C,86C,90C,94C 'fortinet':81C 'improp':68C 'limit':69C 'may':98C 'path':77C 'pathnam':72C 'request':109C 'restrict':75C 'travers':78C 'unauthent':101C 'unauthor':105C 'version':97C 'via':107C 'vulner':79C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126153","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126153","severity":null,"published_at":"2026-11-11T22:17:13+00:00","modified_at":"2026-11-11T22:17:13+00:00","first_seen_at":"2026-11-11T22:29:28+00:00","fetched_at":"2026-11-11T22:29:28+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126153:3664","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-205","severity":null,"published_at":"2026-11-11T22:48:39+00:00","modified_at":"2026-11-11T22:48:39+00:00","first_seen_at":"2026-11-11T22:48:39+00:00","fetched_at":"2026-11-11T22:48:39+00:00","note":"Fortinet FG-IR-26-205: High, CVSS 7.5, unauthenticated, API component, not known exploited, no PoC seen; found internally by Fortinet with Claude Mythos. Web search worked; X not checked. Product rows may collapse by name; 7.2 all versions affected, no fix.","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-205"]}],"documents":[{"id":129721,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-205","title":"Fortinet FG-IR-26-205 FortiMail path traversal","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}