FORTIMAIL · CVE-2026-126167 · Vendor
FIX → 8.0.3 · 7.6.7 +1 ✓ verified
A command injection flaw in Fortinet FortiMail's administrative interface lets an authenticated domain admin or admin send crafted HTTP requests. The attacker can run arbitrary code and CLI commands as root, read or write arbitrary files, and delete users of other tenant domains on a paired FortiAuthenticator.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations running self-hosted FortiMail appliances or VMs in the affected versions. The attacker needs a domain admin or admin account and sends crafted HTTP requests to the administrative interface, gaining root-level code execution and file access, and in multi-tenant setups with a paired FortiAuthenticator can delete other tenants' users. FortiMail Cloud customers can skip it (Fortinet patched it on 2026-10-05).
Not affected if auth-required, managed-hosting
Who cares fortiauthenticator, fortimail, self-hosted
get system status in the FortiMail CLI (or check the admin dashboard) for the firmware version8.0.0-8.0.2, 7.6.0-7.6.6, 7.4.0-7.4.8, all 7.2A improper neutralization of special elements used in a command ('command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 8.0.3 · 7.6.7 +1
7.6.7 or later, 7.4.x to 7.4.9 or later, 8.0.x to 8.0.3 or later (8.0.3 listed as upcoming by Fortinet)