{"id":"CVE-2026-126166","kind":"vulnerability","aliases":["CVE-2026-126166"],"related":[],"title":"Fortinet FortiMail: argument injection lets admins run code as root","description":"A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface.","summary":"FortiMail's administrative interface does not neutralize command arguments, so crafted HTTP requests can pass injected input to system commands. An authenticated domain admin or admin can then run arbitrary code or CLI commands as root, read and write arbitrary files, and delete users of other tenant domains on a paired FortiAuthenticator.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiMail","fixed":["7.6.7","7.4.9","8.0.3 (upcoming)"],"affected":"8.0.0 - 8.0.2; 7.6.0 - 7.6.6; 7.4.0 - 7.4.8; 7.2 all","ecosystem":"vendor"}],"ecosystems":[],"tags":["auth-required","fortiauthenticator","fortimail","multi-tenant","self-hosted","vendor"],"not_affected_if":["fixed-version","fortimail-cloud","managed-hosting","no-admin-access-exposure","not-fortimail-8.0.3-or-later"],"how_to_check":"Run 'get system status' on the FortiMail CLI (or check the GUI dashboard) for the version. Exposed if 8.0.0-8.0.2, 7.6.0-7.6.6, 7.4.0-7.4.8, or any 7.2. Then list admin and domain admin accounts, and note whether a FortiAuthenticator is paired. Also check other FortiMail advisories published the same day.","fix":"FortiMail 7.6.7, 7.4.9 or later; 8.0.3 is announced ('upcoming') and not yet released; 7.2 has no fixed release, migrate to a supported branch. FortiMail Cloud was already updated on 2026-10-05, no action needed.","status":"open","published_at":"2026-11-11T22:17:14+00:00","first_seen_at":"2026-11-11T22:29:29+00:00","triaged_at":"2026-11-11T22:33:49+00:00","updated_at":"2026-11-11T22:47:35+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-11T22:33:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Fortinet FortiMail: argument injection lets admins run code as root","impact":"high","summary":"FortiMail's administrative interface does not neutralize command arguments, so crafted HTTP requests can pass injected input to system commands. An authenticated domain admin or admin can then run arbitrary code or CLI commands as root, read and write arbitrary files, and delete users of other tenant domains on a paired FortiAuthenticator.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortimail","fortiauthenticator","multi-tenant","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs code as root on the appliance","analyst_note":"Find Fortinet's PSIRT advisory for CVE-2026-126166 to confirm fixed versions and workarounds; the NVD record gives none.","how_to_check":"- Check the installed FortiMail version against the affected ranges: 8.0.0 through 8.0.2, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all 7.2 versions.\n- Confirm whether a FortiAuthenticator is paired with the FortiMail appliance.\n- Review who holds domain admin or admin accounts on the administrative interface.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-admin-access-exposure","not-fortimail-8.0.3-or-later"],"who_is_affected":"Organizations running affected FortiMail versions with the administrative interface reachable by admin accounts, especially multi-tenant deployments or those paired with a FortiAuthenticator. Attackers need valid domain admin or admin credentials, so exposure depends on who holds those accounts. The sources do not say whether the fixed versions exist.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000806,"input_tokens":4660,"output_tokens":679,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Fortinet's PSIRT advisory for CVE-2026-126166 to confirm fixed versions and workarounds; the NVD record gives none.","search":"'-126166':13A,16A '-2026':12A,15A '7.2':109C '7.4.0':105C '7.4.8':107C '7.6.0':101C '7.6.6':103C '8.0.0':97C '8.0.2':99C 'admin':6A,53B,55B,120C,122C 'administr':32B,158C 'allow':113C 'arbitrari':59B,69B,136C,141C,148C 'argument':3A,38B,86C,91C 'attack':117C 'auth':19B 'auth-requir':18B 'authent':51B,115C 'cli':62B,142C 'code':8A,60B,137C 'command':37B,49B,63B,90C,143C 'craft':40B,153C 'cve':11A,14A 'delet':72B,125C 'delimit':87C 'domain':52B,77B,119C,130C 'execut':135C 'file':70B,149C 'fortiauthent':21B,81B,134C 'fortimail':2A,17A,22B,30B,96C,100C,104C,108C 'fortinet':1A,95C 'host':28B 'http':41B,154C 'improp':83C 'inject':4A,45B,92C 'input':46B 'interfac':33B,159C 'let':5A 'may':112C 'multi':24B 'multi-ten':23B 'neutral':36B,84C 'pair':80B,133C 'pass':44B 'privileg':123C 'read':66B,145C 'remot':116C 'request':42B,155C 'requir':20B 'root':10A,65B,139C,151C 'run':7A,58B 'self':27B 'self-host':26B 'system':48B 'tenant':25B,76B,129C 'user':73B,126C 'vendor':29B 'version':111C 'via':152C 'vulner':93C 'write':68B,147C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted FortiMail appliances on the affected versions are exposed to anyone holding an admin or domain admin login to the administrative interface. Crafted HTTP requests can run code or CLI commands as root and read or write files; in multi-tenant setups a domain admin can also delete users of other tenant domains on a paired FortiAuthenticator. It needs credentials, so installs with few trusted admins carry less risk; FortiMail Cloud customers can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:47:35Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-218","run_id":3660},"products":{"at":"2026-11-11T22:47:35Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-218","run_id":3660},"how_to_check":{"at":"2026-11-11T22:47:35Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-218","run_id":3660},"who_affected":{"at":"2026-11-11T22:47:35Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-218","run_id":3660}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["fortimail"],"ptokens":["fortimail"],"labels":["authrequired","fortiauthenticator","fortimail","high","multitenant","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126166':13A,16A '-2026':12A,15A 'admin':6A 'argument':3A 'code':8A 'cve':11A,14A 'fortimail':2A,17A 'fortinet':1A 'inject':4A 'let':5A 'root':10A 'run':7A","search_b":"'admin':53B,55B 'administr':32B 'arbitrari':59B,69B 'argument':38B 'auth':19B 'auth-requir':18B 'authent':51B 'cli':62B 'code':60B 'command':37B,49B,63B 'craft':40B 'delet':72B 'domain':52B,77B 'file':70B 'fortiauthent':21B,81B 'fortimail':22B,30B 'host':28B 'http':41B 'inject':45B 'input':46B 'interfac':33B 'multi':24B 'multi-ten':23B 'neutral':36B 'pair':80B 'pass':44B 'read':66B 'request':42B 'requir':20B 'root':65B 'run':58B 'self':27B 'self-host':26B 'system':48B 'tenant':25B,76B 'user':73B 'vendor':29B 'write':68B","search_c":"'7.2':109C '7.4.0':105C '7.4.8':107C '7.6.0':101C '7.6.6':103C '8.0.0':97C '8.0.2':99C 'admin':120C,122C 'administr':158C 'allow':113C 'arbitrari':136C,141C,148C 'argument':86C,91C 'attack':117C 'authent':115C 'cli':142C 'code':137C 'command':90C,143C 'craft':153C 'delet':125C 'delimit':87C 'domain':119C,130C 'execut':135C 'file':149C 'fortiauthent':134C 'fortimail':96C,100C,104C,108C 'fortinet':95C 'http':154C 'improp':83C 'inject':92C 'interfac':159C 'may':112C 'neutral':84C 'pair':133C 'privileg':123C 'read':145C 'remot':116C 'request':155C 'root':139C,151C 'tenant':129C 'user':126C 'version':111C 'via':152C 'vulner':93C 'write':147C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126166","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126166","severity":null,"published_at":"2026-11-11T22:17:14+00:00","modified_at":"2026-11-11T22:17:14+00:00","first_seen_at":"2026-11-11T22:29:29+00:00","fetched_at":"2026-11-11T22:29:29+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126166:3660","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-218","severity":null,"published_at":"2026-11-11T22:47:35+00:00","modified_at":"2026-11-11T22:47:35+00:00","first_seen_at":"2026-11-11T22:47:35+00:00","fetched_at":"2026-11-11T22:47:35+00:00","note":"Read Fortinet FG-IR-26-218 (also covers CVE-2026-126167..69, siblings). Not exploited per vendor; CVSS 7.6; no virtual patch; no workaround stated.","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-218"]}],"documents":[{"id":129719,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-218","title":"Fortinet PSIRT FG-IR-26-218: FortiMail argument injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}