---
id: "CVE-2026-126166"
page: "https://infrastack.ai/live/CVE-2026-126166"
kind: "vulnerability"
aliases: ["CVE-2026-126166"]
title: "Fortinet FortiMail: argument injection lets admins run code as root"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "FortiMail", "fixed": ["7.6.7", "7.4.9", "8.0.3 (upcoming)"], "affected": "8.0.0 - 8.0.2; 7.6.0 - 7.6.6; 7.4.0 - 7.4.8; 7.2 all", "ecosystem": "vendor"}]
ecosystems: []
tags: ["auth-required", "fortiauthenticator", "fortimail", "multi-tenant", "self-hosted", "vendor"]
not_affected_if: ["fixed-version", "fortimail-cloud", "managed-hosting", "no-admin-access-exposure", "not-fortimail-8.0.3-or-later"]
published_at: "2026-11-11T22:17:14+00:00"
first_seen_at: "2026-11-11T22:29:29+00:00"
updated_at: "2026-11-11T22:47:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126166", "first_seen_at": "2026-11-11T22:29:29+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-218", "first_seen_at": "2026-11-11T22:47:35+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-218"]}]
exploit_sources: []
---

# Fortinet FortiMail: argument injection lets admins run code as root

Link for people: https://infrastack.ai/live/CVE-2026-126166 (this .md is for agents)

FortiMail's administrative interface does not neutralize command arguments, so crafted HTTP requests can pass injected input to system commands. An authenticated domain admin or admin can then run arbitrary code or CLI commands as root, read and write arbitrary files, and delete users of other tenant domains on a paired FortiAuthenticator.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiMail affected 8.0.0 - 8.0.2; 7.6.0 - 7.6.6; 7.4.0 - 7.4.8; 7.2 all fixed 7.6.7, 7.4.9, 8.0.3 (upcoming)

## How to check

Run 'get system status' on the FortiMail CLI (or check the GUI dashboard) for the version. Exposed if 8.0.0-8.0.2, 7.6.0-7.6.6, 7.4.0-7.4.8, or any 7.2. Then list admin and domain admin accounts, and note whether a FortiAuthenticator is paired. Also check other FortiMail advisories published the same day.

## Fix

FortiMail 7.6.7, 7.4.9 or later; 8.0.3 is announced ('upcoming') and not yet released; 7.2 has no fixed release, migrate to a supported branch. FortiMail Cloud was already updated on 2026-10-05, no action needed.

## Timeline

- 2026-11-11T22:29:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126166
- 2026-11-11T22:47:35+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-218 — Read Fortinet FG-IR-26-218 (also covers CVE-2026-126167..69, siblings). Not exploited per vendor; CVSS 7.6; no virtual patch; no workaround stated.

## Documents

- [advisory] Fortinet PSIRT FG-IR-26-218: FortiMail argument injection https://fortiguard.fortinet.com/psirt/FG-IR-26-218

## From the sources

A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_