{"id":"CVE-2026-126167","kind":"vulnerability","aliases":["CVE-2026-126167"],"related":[],"title":"Fortinet FortiMail: argument injection in admin interface lets domain admins run code as root","description":"A improper neutralization of special elements used in a command ('command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface.","summary":"A command injection flaw in Fortinet FortiMail's administrative interface lets an authenticated domain admin or admin send crafted HTTP requests. The attacker can run arbitrary code and CLI commands as root, read or write arbitrary files, and delete users of other tenant domains on a paired FortiAuthenticator.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiMail","fixed":["8.0.3","7.6.7","7.4.9"],"affected":">= 8.0.0, <= 8.0.2; >= 7.6.0, <= 7.6.6; >= 7.4.0, <= 7.4.8; 7.2 all","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["fortiauthenticator","fortimail","self-hosted","vendor"],"not_affected_if":["auth-required","managed-hosting"],"how_to_check":"Run 'get system status' in the FortiMail CLI (or check the admin dashboard) for the firmware version. Affected: 8.0.0-8.0.2, 7.6.0-7.6.6, 7.4.0-7.4.8, all 7.2. Also check whether a FortiAuthenticator is paired, since the flaw can delete users of other tenant domains there. Restrict the admin interface to trusted networks until patched. FortiMail Cloud is not affected.","fix":"Upgrade FortiMail 7.6.x to 7.6.7 or later, 7.4.x to 7.4.9 or later, 8.0.x to 8.0.3 or later (8.0.3 listed as upcoming by Fortinet). FortiMail 7.2 has no fix: migrate to a fixed release. FortiMail Cloud was already updated on 2026-10-05; no customer action.","status":"open","published_at":"2026-11-11T22:17:14+00:00","first_seen_at":"2026-11-11T22:29:29+00:00","triaged_at":"2026-11-11T22:33:49+00:00","updated_at":"2026-11-11T22:47:26+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-11T22:33:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Fortinet FortiMail: admin command injection lets attackers run code as root","impact":"high","summary":"A command injection flaw in Fortinet FortiMail's administrative interface lets an authenticated domain admin or admin send crafted HTTP requests. The attacker can run arbitrary code and CLI commands as root, read or write arbitrary files, and delete users of other tenant domains on a paired FortiAuthenticator.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortimail","fortiauthenticator","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs code as root on the appliance","analyst_note":"Confirm the fixed FortiMail versions and any vendor advisory (Fortinet PSIRT) since the sources give none.","how_to_check":"- Check the FortiMail firmware version under the admin dashboard or with `get system status` in the CLI, and compare it to the affected ranges 8.0.0 through 8.0.2, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2 (all versions).\n- Check whether a FortiAuthenticator is paired with the FortiMail appliance.","plain_action":"","product_name":"FortiMail","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"Organizations running Fortinet FortiMail email security appliances in the affected version ranges. The flaw requires an account with domain admin or admin privileges and reaches the administrative web interface; exposure is greater where the admin interface is reachable from untrusted networks and where a FortiAuthenticator is paired. Sources do not say which configurations are safe.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000798,"input_tokens":4654,"output_tokens":666,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed FortiMail versions and any vendor advisory (Fortinet PSIRT) since the sources give none.","search":"'-126167':17A,20A '-2026':16A,19A '7.2':104C '7.4.0':100C '7.4.8':102C '7.6.0':96C '7.6.6':98C '8.0.0':92C '8.0.2':94C 'admin':6A,10A,42B,44B,115C,117C 'administr':36B,153C 'allow':108C 'arbitrari':53B,63B,131C,136C,143C 'argument':3A 'attack':50B,112C 'authent':40B,110C 'cli':56B,137C 'code':12A,54B,132C 'command':29B,57B,85C,86C,138C 'craft':46B,148C 'cve':15A,18A 'delet':66B,120C 'domain':9A,41B,71B,114C,125C 'element':81C 'execut':130C 'file':64B,144C 'flaw':31B 'fortiauthent':22B,75B,129C 'fortimail':2A,21A,23B,34B,91C,95C,99C,103C 'fortinet':1A,33B,90C 'host':26B 'http':47B,149C 'improp':77C 'inject':4A,30B,87C 'interfac':7A,37B,154C 'let':8A,38B 'may':107C 'neutral':78C 'pair':74B,128C 'privileg':118C 'read':60B,140C 'remot':111C 'request':48B,150C 'root':14A,59B,134C,146C 'run':11A,52B 'self':25B 'self-host':24B 'send':45B 'special':80C 'tenant':70B,124C 'use':82C 'user':67B,121C 'vendor':27B 'version':106C 'via':147C 'vulner':88C 'write':62B,142C","nicknames":[],"mitigations":[],"who_affected":"Organizations running self-hosted FortiMail appliances or VMs in the affected versions. The attacker needs a domain admin or admin account and sends crafted HTTP requests to the administrative interface, gaining root-level code execution and file access, and in multi-tenant setups with a paired FortiAuthenticator can delete other tenants' users. FortiMail Cloud customers can skip it (Fortinet patched it on 2026-10-05).","tier":"B","verified":{"fix":{"at":"2026-11-11T22:47:26Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-218","run_id":3659},"products":{"at":"2026-11-11T22:47:26Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-218","run_id":3659},"how_to_check":{"at":"2026-11-11T22:47:26Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-218","run_id":3659},"who_affected":{"at":"2026-11-11T22:47:26Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-218","run_id":3659}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["fortimail"],"ptokens":["fortimail"],"labels":["fortiauthenticator","fortimail","high","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126167':17A,20A '-2026':16A,19A 'admin':6A,10A 'argument':3A 'code':12A 'cve':15A,18A 'domain':9A 'fortimail':2A,21A 'fortinet':1A 'inject':4A 'interfac':7A 'let':8A 'root':14A 'run':11A","search_b":"'admin':42B,44B 'administr':36B 'arbitrari':53B,63B 'attack':50B 'authent':40B 'cli':56B 'code':54B 'command':29B,57B 'craft':46B 'delet':66B 'domain':41B,71B 'file':64B 'flaw':31B 'fortiauthent':22B,75B 'fortimail':23B,34B 'fortinet':33B 'host':26B 'http':47B 'inject':30B 'interfac':37B 'let':38B 'pair':74B 'read':60B 'request':48B 'root':59B 'run':52B 'self':25B 'self-host':24B 'send':45B 'tenant':70B 'user':67B 'vendor':27B 'write':62B","search_c":"'7.2':104C '7.4.0':100C '7.4.8':102C '7.6.0':96C '7.6.6':98C '8.0.0':92C '8.0.2':94C 'admin':115C,117C 'administr':153C 'allow':108C 'arbitrari':131C,136C,143C 'attack':112C 'authent':110C 'cli':137C 'code':132C 'command':85C,86C,138C 'craft':148C 'delet':120C 'domain':114C,125C 'element':81C 'execut':130C 'file':144C 'fortiauthent':129C 'fortimail':91C,95C,99C,103C 'fortinet':90C 'http':149C 'improp':77C 'inject':87C 'interfac':154C 'may':107C 'neutral':78C 'pair':128C 'privileg':118C 'read':140C 'remot':111C 'request':150C 'root':134C,146C 'special':80C 'tenant':124C 'use':82C 'user':121C 'version':106C 'via':147C 'vulner':88C 'write':142C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126167","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126167","severity":null,"published_at":"2026-11-11T22:17:14+00:00","modified_at":"2026-11-11T22:17:14+00:00","first_seen_at":"2026-11-11T22:29:29+00:00","fetched_at":"2026-11-11T22:29:29+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126167:3659","url":"https://www.fortiguard.com/psirt/FG-IR-26-218","severity":null,"published_at":"2026-11-11T22:47:26+00:00","modified_at":"2026-11-11T22:47:26+00:00","first_seen_at":"2026-11-11T22:47:26+00:00","fetched_at":"2026-11-11T22:47:26+00:00","note":"Fortinet PSIRT FG-IR-26-218 (covers CVE-2026-126166..169) read: CWE-88 argument injection, versions and fixes confirmed; 8.0.3 still 'upcoming'; Known Exploited: No. No posts/X checked. Severity unchanged (vendor CVSS 7.6/NVD 7.2).","cites":["https://www.fortiguard.com/psirt/FG-IR-26-218"]}],"documents":[{"id":129714,"url":"https://www.fortiguard.com/psirt/FG-IR-26-218","title":"Fortinet PSIRT FG-IR-26-218: FortiMail argument injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}