---
id: "CVE-2026-126158"
page: "https://infrastack.ai/live/CVE-2026-126158"
kind: "vulnerability"
aliases: ["CVE-2026-126158"]
title: "Fortinet FortiMail: admin OS command injection lets attacker run commands as root"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["appliance", "email-gateway", "fortimail", "fortinet", "infrastructure"]
not_affected_if: ["no-admin-exposure", "other-versions"]
published_at: "2026-11-11T22:17:13+00:00"
first_seen_at: "2026-11-11T22:29:28+00:00"
updated_at: "2026-11-11T22:33:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126158", "first_seen_at": "2026-11-11T22:29:28+00:00"}]
exploit_sources: []
---

# Fortinet FortiMail: admin OS command injection lets attacker run commands as root

Link for people: https://infrastack.ai/live/CVE-2026-126158 (this .md is for agents)

FortiMail 8.0.0 through 8.0.1 has an OS command injection flaw triggered by specially crafted HTTP requests. An authenticated administrator can run arbitrary commands as root on the appliance.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed FortiMail version in the admin GUI or CLI and compare it with the affected range `8.0.0` to `8.0.1`

## Fix

- Move FortiMail to a version later than `8.0.1`; the sources do not name the exact fixed version

## Timeline

- 2026-11-11T22:29:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126158

## From the sources

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1 may allow an authenticated administrator to execute unauthorized code or commands as root via specially crafted HTTP requests.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_