FORTIMAIL · CVE-2026-126168 · Vendor
FIX → 8.0.3 · 7.6.7 +1 ✓ verified
FortiMail's administrative interface does not neutralize argument delimiters, so crafted HTTP requests can pass injected arguments to internal commands. An authenticated domain admin or admin can run arbitrary code and CLI commands as root, read or write arbitrary files, and delete users of other tenant domains on a paired FortiAuthenticator.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-hosted FortiMail appliances or VMs on 8.0.0-8.0.2, 7.6.0-7.6.6, 7.4.0-7.4.8 or any 7.2. An attacker needs an authenticated admin or domain admin account and access to the administrative HTTP interface, then can run code as root, read or write files, and delete users of other tenant domains on a paired FortiAuthenticator. Multi-tenant or hosted-for-customers setups, where domain admins are less trusted, matter most. FortiMail Cloud customers can skip it: Fortinet patched it on 2026-10-05.
Not affected if admin-interface-not-exposed, fortimail-cloud, no-admin-accounts-untrusted, no-untrusted-admin-accounts
Who cares email-gateway, fortiauthenticator, fortimail, fortinet, self-hosted
A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 8.0.3 · 7.6.7 +1
7.6.7 or above7.4.9 or above8.0.3 or above (Fortinet lists 8.0.3 as upcoming, not yet released as of the advisory of 2026-11-10)v7.6.7 / v8.0.2), no customer action