---
id: "CVE-2026-126168"
page: "https://infrastack.ai/live/CVE-2026-126168"
kind: "vulnerability"
aliases: ["CVE-2026-126168"]
title: "Fortinet FortiMail: argument injection lets admins run code as root"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "FortiMail", "fixed": ["7.4.9", "7.6.7", "8.0.3"], "affected": "7.2 all versions; >= 7.4.0, < 7.4.9; >= 7.6.0, < 7.6.7; >= 8.0.0, < 8.0.3", "ecosystem": "vendor"}]
ecosystems: []
tags: ["email-gateway", "fortiauthenticator", "fortimail", "fortinet", "self-hosted", "vendor"]
not_affected_if: ["admin-interface-not-exposed", "fortimail-cloud", "no-admin-accounts-untrusted", "no-untrusted-admin-accounts"]
published_at: "2026-11-11T22:17:15+00:00"
first_seen_at: "2026-11-11T22:29:29+00:00"
updated_at: "2026-11-11T22:46:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126168", "first_seen_at": "2026-11-11T22:29:29+00:00"}, {"source": "analyst", "url": "https://www.fortiguard.com/psirt/FG-IR-26-218", "first_seen_at": "2026-11-11T22:46:29+00:00", "cites": ["https://www.fortiguard.com/psirt/FG-IR-26-218"]}]
exploit_sources: []
---

# Fortinet FortiMail: argument injection lets admins run code as root

Link for people: https://infrastack.ai/live/CVE-2026-126168 (this .md is for agents)

FortiMail's administrative interface does not neutralize argument delimiters, so crafted HTTP requests can pass injected arguments to internal commands. An authenticated domain admin or admin can run arbitrary code and CLI commands as root, read or write arbitrary files, and delete users of other tenant domains on a paired FortiAuthenticator.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiMail affected 7.2 all versions; >= 7.4.0, < 7.4.9; >= 7.6.0, < 7.6.7; >= 8.0.0, < 8.0.3 fixed 7.4.9, 7.6.7, 8.0.3

## How to check

- Run 'get system status' in the FortiMail CLI (or look at the admin dashboard) and compare the firmware with the affected ranges: 8.0.0-8.0.2, 7.6.0-7.6.6, 7.4.0-7.4.8, any 7.2.
- Review which accounts hold admin or domain admin rights; the attacker needs one of them.
- Check whether the admin interface (GUI/HTTP) is reachable from untrusted networks.
- If FortiMail is paired with a FortiAuthenticator, users of other tenant domains on it can be deleted through this flaw. FortiAuthenticator itself is not listed as affected.

## Fix

FortiMail 7.6: upgrade to 7.6.7 or above. FortiMail 7.4: upgrade to 7.4.9 or above. FortiMail 8.0: upgrade to 8.0.3 or above (Fortinet lists 8.0.3 as upcoming, not yet released as of the advisory of 2026-11-10). FortiMail 7.2: no patch, migrate to a fixed release. FortiMail Cloud was already updated by Fortinet on 2026-10-05 (v7.6.7 / v8.0.2), no customer action.

## Timeline

- 2026-11-11T22:29:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126168
- 2026-11-11T22:46:29+00:00 analyst https://www.fortiguard.com/psirt/FG-IR-26-218 — Corrected product row: one FortiMail row covering all branches (7.2 all, 7.4 <7.4.9, 7.6 <7.6.7, 8.0 <8.0.3 upcoming), per FG-IR-26-218.

## Documents

- [advisory] Fortinet PSIRT FG-IR-26-218: FortiMail argument injection https://www.fortiguard.com/psirt/FG-IR-26-218

## From the sources

A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_