{"id":"CVE-2026-126158","kind":"vulnerability","aliases":["CVE-2026-126158"],"related":[],"title":"Fortinet FortiMail: admin OS command injection lets attacker run commands as root","description":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1 may allow an authenticated administrator to execute unauthorized code or commands as root via specially crafted HTTP requests.","summary":"FortiMail 8.0.0 through 8.0.1 has an OS command injection flaw triggered by specially crafted HTTP requests. An authenticated administrator can run arbitrary commands as root on the appliance.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["appliance","email-gateway","fortimail","fortinet","infrastructure"],"not_affected_if":["no-admin-exposure","other-versions"],"how_to_check":"- Check the installed FortiMail version in the admin GUI or CLI and compare it with the affected range `8.0.0` to `8.0.1`","fix":"- Move FortiMail to a version later than `8.0.1`; the sources do not name the exact fixed version","status":"open","published_at":"2026-11-11T22:17:13+00:00","first_seen_at":"2026-11-11T22:29:28+00:00","triaged_at":"2026-11-11T22:33:51+00:00","updated_at":"2026-11-11T22:33:51+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-11T22:33:51Z","model":"claude-haiku-5-5","output":{"fix":"- Move FortiMail to a version later than `8.0.1`; the sources do not name the exact fixed version","reach":"network","title":"Fortinet FortiMail: admin OS command injection lets attacker run commands as root","impact":"high","summary":"FortiMail 8.0.0 through 8.0.1 has an OS command injection flaw triggered by specially crafted HTTP requests. An authenticated administrator can run arbitrary commands as root on the appliance.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortimail","fortinet","email-gateway","appliance"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs arbitrary commands as root on the appliance","analyst_note":"Find the fixed FortiMail version and the Fortinet advisory for CVE-2026-126158 to confirm fix and how_to_check.","how_to_check":"- Check the installed FortiMail version in the admin GUI or CLI and compare it with the affected range `8.0.0` to `8.0.1`\n- unknown for other checks: the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-versions","no-admin-exposure"],"who_is_affected":"Organizations running Fortinet FortiMail 8.0.0 through 8.0.1 are exposed, and the flaw needs an authenticated administrator account. Teams on other FortiMail versions or without admin access exposed to attackers can treat it as lower risk, but should still confirm the version.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000742,"input_tokens":4537,"output_tokens":577,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126158':15A,18A '-2026':14A,17A '8.0.0':27B,72C '8.0.1':29B,74C 'admin':3A 'administr':44B,79C 'allow':76C 'applianc':19B,53B 'arbitrari':47B 'attack':8A 'authent':43B,78C 'code':83C 'command':5A,10A,33B,48B,64C,66C,85C 'craft':39B,90C 'cve':13A,16A 'element':59C 'email':21B 'email-gateway':20B 'execut':81C 'flaw':35B 'fortimail':2A,23B,26B,71C 'fortinet':1A,24B,70C 'gateway':22B 'http':40B,91C 'improp':55C 'infrastructur':25B 'inject':6A,34B,67C 'let':7A 'may':75C 'neutral':56C 'os':4A,32B,63C,65C 'request':41B,92C 'root':12A,50B,87C 'run':9A,46B 'special':38B,58C,89C 'trigger':36B 'unauthor':82C 'use':60C 'via':88C 'vulner':68C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Fortinet FortiMail 8.0.0 through 8.0.1 are exposed, and the flaw needs an authenticated administrator account. Teams on other FortiMail versions or without admin access exposed to attackers can treat it as lower risk, but should still confirm the version.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["appliance","emailgateway","fortimail","fortinet","high","infrastructure"],"campaign_type":null,"search_a":"'-126158':15A,18A '-2026':14A,17A 'admin':3A 'attack':8A 'command':5A,10A 'cve':13A,16A 'fortimail':2A 'fortinet':1A 'inject':6A 'let':7A 'os':4A 'root':12A 'run':9A","search_b":"'8.0.0':27B '8.0.1':29B 'administr':44B 'applianc':19B,53B 'arbitrari':47B 'authent':43B 'command':33B,48B 'craft':39B 'email':21B 'email-gateway':20B 'flaw':35B 'fortimail':23B,26B 'fortinet':24B 'gateway':22B 'http':40B 'infrastructur':25B 'inject':34B 'os':32B 'request':41B 'root':50B 'run':46B 'special':38B 'trigger':36B","search_c":"'8.0.0':72C '8.0.1':74C 'administr':79C 'allow':76C 'authent':78C 'code':83C 'command':64C,66C,85C 'craft':90C 'element':59C 'execut':81C 'fortimail':71C 'fortinet':70C 'http':91C 'improp':55C 'inject':67C 'may':75C 'neutral':56C 'os':63C,65C 'request':92C 'root':87C 'special':58C,89C 'unauthor':82C 'use':60C 'via':88C 'vulner':68C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126158","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126158","severity":null,"published_at":"2026-11-11T22:17:13+00:00","modified_at":"2026-11-11T22:17:13+00:00","first_seen_at":"2026-11-11T22:29:28+00:00","fetched_at":"2026-11-11T22:29:28+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}