FORTIMAIL · CVE-2026-126169 · Vendor
FIX → 8.0.3 · 7.6.7 +1 ✓ verified
Fortinet FortiMail mail gateways fail to neutralize argument delimiters in a command, so a crafted HTTP request to the admin interface can pass extra arguments to a system command. An authenticated domain admin or admin can then run arbitrary code or CLI commands as root, read or write any file, and delete users of other tenant domains on a paired FortiAuthenticator.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-hosted FortiMail appliances and VMs on 8.0.0-8.0.2, 7.6.0-7.6.6, 7.4.0-7.4.8 or any 7.2. Exploitation needs an authenticated domain admin or admin account that sends crafted HTTP requests to the administrative interface. It can then run code as root, read or write files, and delete users of other tenant domains on a paired FortiAuthenticator. FortiMail Cloud customers can skip it, since Fortinet patched Cloud on Oct 5, 2026.
Not affected if admin-interface-restricted, default-config, fortimail-cloud, managed-hosting, no-admin-access
Who cares email-gateway, fortiauthenticator, fortimail, fortinet, self-hosted
get system status in the FortiMail CLI (or read the system dashboard) and compare the version: affected are 8.0.0-8.0.2, 7.6.0-7.6.6, 7.4.0-7.4.8 and all 7.2A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 8.0.3 · 7.6.7 +1
7.6.7 or above. 7.4: upgrade to 7.4.9 or above. 8.0: upgrade to 8.0.3 or above (Fortinet lists 8.0.3 as upcoming on Nov 10, 2026). 7.2: no fixed release, migrate to a fixed branchv7.6.7 or v8.0.2 GA); no action needed