{"id":"CVE-2026-126168","kind":"vulnerability","aliases":["CVE-2026-126168"],"related":[],"title":"Fortinet FortiMail: argument injection lets admins run code as root","description":"A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface.","summary":"FortiMail's administrative interface does not neutralize argument delimiters, so crafted HTTP requests can pass injected arguments to internal commands. An authenticated domain admin or admin can run arbitrary code and CLI commands as root, read or write arbitrary files, and delete users of other tenant domains on a paired FortiAuthenticator.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiMail","fixed":["7.4.9","7.6.7","8.0.3"],"affected":"7.2 all versions; >= 7.4.0, < 7.4.9; >= 7.6.0, < 7.6.7; >= 8.0.0, < 8.0.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["email-gateway","fortiauthenticator","fortimail","fortinet","self-hosted","vendor"],"not_affected_if":["admin-interface-not-exposed","fortimail-cloud","no-admin-accounts-untrusted","no-untrusted-admin-accounts"],"how_to_check":"- Run 'get system status' in the FortiMail CLI (or look at the admin dashboard) and compare the firmware with the affected ranges: 8.0.0-8.0.2, 7.6.0-7.6.6, 7.4.0-7.4.8, any 7.2.\n- Review which accounts hold admin or domain admin rights; the attacker needs one of them.\n- Check whether the admin interface (GUI/HTTP) is reachable from untrusted networks.\n- If FortiMail is paired with a FortiAuthenticator, users of other tenant domains on it can be deleted through this flaw. FortiAuthenticator itself is not listed as affected.","fix":"FortiMail 7.6: upgrade to 7.6.7 or above. FortiMail 7.4: upgrade to 7.4.9 or above. FortiMail 8.0: upgrade to 8.0.3 or above (Fortinet lists 8.0.3 as upcoming, not yet released as of the advisory of 2026-11-10). FortiMail 7.2: no patch, migrate to a fixed release. FortiMail Cloud was already updated by Fortinet on 2026-10-05 (v7.6.7 / v8.0.2), no customer action.","status":"open","published_at":"2026-11-11T22:17:15+00:00","first_seen_at":"2026-11-11T22:29:29+00:00","triaged_at":"2026-11-11T22:33:48+00:00","updated_at":"2026-11-11T22:46:33+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-11-11T22:33:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Fortinet FortiMail: argument injection lets admins run code as root","impact":"high","summary":"FortiMail's administrative interface does not neutralize argument delimiters, so crafted HTTP requests can pass injected arguments to internal commands. An authenticated domain admin or admin can run arbitrary code and CLI commands as root, read or write arbitrary files, and delete users of other tenant domains on a paired FortiAuthenticator.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortimail","fortiauthenticator","email-gateway","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs arbitrary code as root on the appliance","analyst_note":"Confirm the fixed versions and any vendor advisory from Fortinet's PSIRT; the sources give no fix and no exploitation status.","how_to_check":"- Check the installed FortiMail firmware version under the admin dashboard or with `get system status` in the CLI, and compare it with the affected ranges 8.0.0 through 8.0.2, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2 (all versions).\n- Check whether FortiMail is paired with a FortiAuthenticator.\n- Review which accounts hold domain admin or admin privileges.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["admin-interface-not-exposed","no-admin-accounts-untrusted"],"who_is_affected":"Organizations running FortiMail 8.0.0 through 8.0.2, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, or any 7.2 release. The attacker needs domain admin or admin credentials and access to the administrative interface over HTTP, so exposure is greatest where the admin interface is reachable from untrusted networks. Deployments without a paired FortiAuthenticator still face root code execution from an admin account.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000846,"input_tokens":4660,"output_tokens":759,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed versions and any vendor advisory from Fortinet's PSIRT; the sources give no fix and no exploitation status.","search":"'-126168':13A,16A '-2026':12A,15A '7.2':106C '7.4.0':102C '7.4.8':104C '7.6.0':98C '7.6.6':100C '8.0.0':94C '8.0.2':96C 'admin':6A,51B,53B,117C,119C 'administr':30B,155C 'allow':110C 'arbitrari':56B,66B,133C,138C,145C 'argument':3A,35B,44B,83C,88C 'attack':114C 'authent':49B,112C 'cli':59B,139C 'code':8A,57B,134C 'command':47B,60B,87C,140C 'craft':38B,150C 'cve':11A,14A 'delet':69B,122C 'delimit':36B,84C 'domain':50B,74B,116C,127C 'email':19B 'email-gateway':18B 'execut':132C 'file':67B,146C 'fortiauthent':21B,78B,131C 'fortimail':2A,17A,22B,28B,93C,97C,101C,105C 'fortinet':1A,23B,92C 'gateway':20B 'host':26B 'http':39B,151C 'improp':80C 'inject':4A,43B,89C 'interfac':31B,156C 'intern':46B 'let':5A 'may':109C 'neutral':34B,81C 'pair':77B,130C 'pass':42B 'privileg':120C 'read':63B,142C 'remot':113C 'request':40B,152C 'root':10A,62B,136C,148C 'run':7A,55B 'self':25B 'self-host':24B 'tenant':73B,126C 'user':70B,123C 'vendor':27B 'version':108C 'via':149C 'vulner':90C 'write':65B,144C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted FortiMail appliances or VMs on 8.0.0-8.0.2, 7.6.0-7.6.6, 7.4.0-7.4.8 or any 7.2. An attacker needs an authenticated admin or domain admin account and access to the administrative HTTP interface, then can run code as root, read or write files, and delete users of other tenant domains on a paired FortiAuthenticator. Multi-tenant or hosted-for-customers setups, where domain admins are less trusted, matter most. FortiMail Cloud customers can skip it: Fortinet patched it on 2026-10-05.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:46:29Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-218","run_id":3658},"products":{"at":"2026-11-11T22:46:33Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-218","run_id":3658},"how_to_check":{"at":"2026-11-11T22:46:29Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-218","run_id":3658},"who_affected":{"at":"2026-11-11T22:46:29Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-218","run_id":3658}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["fortimail"],"ptokens":["fortimail"],"labels":["emailgateway","fortiauthenticator","fortimail","fortinet","high","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126168':13A,16A '-2026':12A,15A 'admin':6A 'argument':3A 'code':8A 'cve':11A,14A 'fortimail':2A,17A 'fortinet':1A 'inject':4A 'let':5A 'root':10A 'run':7A","search_b":"'admin':51B,53B 'administr':30B 'arbitrari':56B,66B 'argument':35B,44B 'authent':49B 'cli':59B 'code':57B 'command':47B,60B 'craft':38B 'delet':69B 'delimit':36B 'domain':50B,74B 'email':19B 'email-gateway':18B 'file':67B 'fortiauthent':21B,78B 'fortimail':22B,28B 'fortinet':23B 'gateway':20B 'host':26B 'http':39B 'inject':43B 'interfac':31B 'intern':46B 'neutral':34B 'pair':77B 'pass':42B 'read':63B 'request':40B 'root':62B 'run':55B 'self':25B 'self-host':24B 'tenant':73B 'user':70B 'vendor':27B 'write':65B","search_c":"'7.2':106C '7.4.0':102C '7.4.8':104C '7.6.0':98C '7.6.6':100C '8.0.0':94C '8.0.2':96C 'admin':117C,119C 'administr':155C 'allow':110C 'arbitrari':133C,138C,145C 'argument':83C,88C 'attack':114C 'authent':112C 'cli':139C 'code':134C 'command':87C,140C 'craft':150C 'delet':122C 'delimit':84C 'domain':116C,127C 'execut':132C 'file':146C 'fortiauthent':131C 'fortimail':93C,97C,101C,105C 'fortinet':92C 'http':151C 'improp':80C 'inject':89C 'interfac':156C 'may':109C 'neutral':81C 'pair':130C 'privileg':120C 'read':142C 'remot':113C 'request':152C 'root':136C,148C 'tenant':126C 'user':123C 'version':108C 'via':149C 'vulner':90C 'write':144C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126168","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126168","severity":null,"published_at":"2026-11-11T22:17:15+00:00","modified_at":"2026-11-11T22:17:15+00:00","first_seen_at":"2026-11-11T22:29:29+00:00","fetched_at":"2026-11-11T22:29:29+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126168:3658","url":"https://www.fortiguard.com/psirt/FG-IR-26-218","severity":null,"published_at":"2026-11-11T22:46:29+00:00","modified_at":"2026-11-11T22:46:33+00:00","first_seen_at":"2026-11-11T22:46:29+00:00","fetched_at":"2026-11-11T22:46:33+00:00","note":"Corrected product row: one FortiMail row covering all branches (7.2 all, 7.4 <7.4.9, 7.6 <7.6.7, 8.0 <8.0.3 upcoming), per FG-IR-26-218.","cites":["https://www.fortiguard.com/psirt/FG-IR-26-218"]}],"documents":[{"id":129714,"url":"https://www.fortiguard.com/psirt/FG-IR-26-218","title":"Fortinet PSIRT FG-IR-26-218: FortiMail argument injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}