FORTIMAIL · CVE-2026-126166 · Vendor
FIX → 8.0.3 (upcoming) · 7.6.7 +1 ✓ verified
FortiMail's administrative interface does not neutralize command arguments, so crafted HTTP requests can pass injected input to system commands. An authenticated domain admin or admin can then run arbitrary code or CLI commands as root, read and write arbitrary files, and delete users of other tenant domains on a paired FortiAuthenticator.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-hosted FortiMail appliances on the affected versions are exposed to anyone holding an admin or domain admin login to the administrative interface. Crafted HTTP requests can run code or CLI commands as root and read or write files; in multi-tenant setups a domain admin can also delete users of other tenant domains on a paired FortiAuthenticator. It needs credentials, so installs with few trusted admins carry less risk; FortiMail Cloud customers can skip it.
Not affected if fixed-version, fortimail-cloud, managed-hosting, no-admin-access-exposure, not-fortimail-8.0.3-or-later
Who cares auth-required, fortiauthenticator, fortimail, multi-tenant, self-hosted
get system status on the FortiMail CLI (or check the GUI dashboard) for the version8.0.0-8.0.2, 7.6.0-7.6.6, , or any 7.2A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
7.4.0-7.4.8Upgrade to 8.0.3 (upcoming) · 7.6.7 +1
7.6.7, 7.4.9 or later; 8.0.3 is announced (upcoming) and not yet released; 7.2 has no fixed release, migrate to a supported branch