---
id: "CVE-2026-126167"
page: "https://infrastack.ai/live/CVE-2026-126167"
kind: "vulnerability"
aliases: ["CVE-2026-126167"]
title: "Fortinet FortiMail: argument injection in admin interface lets domain admins run code as root"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "FortiMail", "fixed": ["8.0.3", "7.6.7", "7.4.9"], "affected": ">= 8.0.0, <= 8.0.2; >= 7.6.0, <= 7.6.6; >= 7.4.0, <= 7.4.8; 7.2 all", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["fortiauthenticator", "fortimail", "self-hosted", "vendor"]
not_affected_if: ["auth-required", "managed-hosting"]
published_at: "2026-11-11T22:17:14+00:00"
first_seen_at: "2026-11-11T22:29:29+00:00"
updated_at: "2026-11-11T22:47:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126167", "first_seen_at": "2026-11-11T22:29:29+00:00"}, {"source": "analyst", "url": "https://www.fortiguard.com/psirt/FG-IR-26-218", "first_seen_at": "2026-11-11T22:47:26+00:00", "cites": ["https://www.fortiguard.com/psirt/FG-IR-26-218"]}]
exploit_sources: []
---

# Fortinet FortiMail: argument injection in admin interface lets domain admins run code as root

Link for people: https://infrastack.ai/live/CVE-2026-126167 (this .md is for agents)

A command injection flaw in Fortinet FortiMail's administrative interface lets an authenticated domain admin or admin send crafted HTTP requests. The attacker can run arbitrary code and CLI commands as root, read or write arbitrary files, and delete users of other tenant domains on a paired FortiAuthenticator.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiMail affected >= 8.0.0, <= 8.0.2; >= 7.6.0, <= 7.6.6; >= 7.4.0, <= 7.4.8; 7.2 all fixed 8.0.3, 7.6.7, 7.4.9

## How to check

Run 'get system status' in the FortiMail CLI (or check the admin dashboard) for the firmware version. Affected: 8.0.0-8.0.2, 7.6.0-7.6.6, 7.4.0-7.4.8, all 7.2. Also check whether a FortiAuthenticator is paired, since the flaw can delete users of other tenant domains there. Restrict the admin interface to trusted networks until patched. FortiMail Cloud is not affected.

## Fix

Upgrade FortiMail 7.6.x to 7.6.7 or later, 7.4.x to 7.4.9 or later, 8.0.x to 8.0.3 or later (8.0.3 listed as upcoming by Fortinet). FortiMail 7.2 has no fix: migrate to a fixed release. FortiMail Cloud was already updated on 2026-10-05; no customer action.

## Timeline

- 2026-11-11T22:29:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126167
- 2026-11-11T22:47:26+00:00 analyst https://www.fortiguard.com/psirt/FG-IR-26-218 — Fortinet PSIRT FG-IR-26-218 (covers CVE-2026-126166..169) read: CWE-88 argument injection, versions and fixes confirmed; 8.0.3 still 'upcoming'; Known Exploited: No. No posts/X checked. Severity unchanged (vendor CVSS 7.6/NVD 7.2).

## Documents

- [advisory] Fortinet PSIRT FG-IR-26-218: FortiMail argument injection https://www.fortiguard.com/psirt/FG-IR-26-218

## From the sources

A improper neutralization of special elements used in a command ('command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_