---
id: "CVE-2026-126153"
page: "https://infrastack.ai/live/CVE-2026-126153"
kind: "vulnerability"
aliases: ["CVE-2026-126153"]
title: "FortiMail: path traversal in the API lets unauthenticated attackers run commands (fixed in 8.0.2, 7.6.7, 7.4.9)"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "FortiMail", "fixed": ["8.0.2"], "affected": ">= 8.0.0, <= 8.0.1", "ecosystem": "vendor"}, {"name": "FortiMail", "fixed": ["7.6.7"], "affected": ">= 7.6.0, <= 7.6.6", "ecosystem": "vendor"}, {"name": "FortiMail", "fixed": ["7.4.9"], "affected": ">= 7.4.0, <= 7.4.8", "ecosystem": "vendor"}]
ecosystems: []
tags: ["email-gateway", "fortimail", "fortinet", "self-hosted", "unauthenticated", "vendor"]
not_affected_if: ["fortimail-cloud", "managed-hosting", "unaffected-version"]
published_at: "2026-11-11T22:17:13+00:00"
first_seen_at: "2026-11-11T22:29:28+00:00"
updated_at: "2026-11-11T22:48:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126153", "first_seen_at": "2026-11-11T22:29:28+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-205", "first_seen_at": "2026-11-11T22:48:39+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-205"]}]
exploit_sources: []
---

# FortiMail: path traversal in the API lets unauthenticated attackers run commands (fixed in 8.0.2, 7.6.7, 7.4.9)

Link for people: https://infrastack.ai/live/CVE-2026-126153 (this .md is for agents)

A path traversal flaw in Fortinet FortiMail lets an attacker escape a restricted directory using crafted requests. According to the description, an unauthenticated attacker may be able to execute unauthorized commands.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiMail affected >= 8.0.0, <= 8.0.1 fixed 8.0.2
- vendor:FortiMail affected >= 7.6.0, <= 7.6.6 fixed 7.6.7
- vendor:FortiMail affected >= 7.4.0, <= 7.4.8 fixed 7.4.9

## How to check

Check the FortiMail firmware version (admin GUI dashboard or CLI 'get system status'). Exposed if it is 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, or any 7.2. FortiMail Cloud customers need no action. Fortinet lists no virtual patch and no workaround.

## Fix

Upgrade FortiMail 8.0 to 8.0.2 or above, 7.6 to 7.6.7 or above, 7.4 to 7.4.9 or above. 7.2 has no fixed release: migrate to a fixed branch. FortiMail Cloud was already updated on Oct 05, 2026.

## Timeline

- 2026-11-11T22:29:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126153
- 2026-11-11T22:48:39+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-205 — Fortinet FG-IR-26-205: High, CVSS 7.5, unauthenticated, API component, not known exploited, no PoC seen; found internally by Fortinet with Claude Mythos. Web search worked; X not checked. Product rows may collapse by name; 7.2 all versions affected, no fix.

## Documents

- [advisory] Fortinet FG-IR-26-205 FortiMail path traversal https://fortiguard.fortinet.com/psirt/FG-IR-26-205

## From the sources

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to execute unauthorized commands via crafted requests.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_