{"id":"CVE-2026-126169","kind":"vulnerability","aliases":["CVE-2026-126169"],"related":[],"title":"Fortinet FortiMail: argument injection lets admins run code as root","description":"A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface.","summary":"Fortinet FortiMail mail gateways fail to neutralize argument delimiters in a command, so a crafted HTTP request to the admin interface can pass extra arguments to a system command. An authenticated domain admin or admin can then run arbitrary code or CLI commands as root, read or write any file, and delete users of other tenant domains on a paired FortiAuthenticator.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiMail","fixed":["7.4.9","7.6.7","8.0.3"],"affected":">= 7.2.0, < 7.4.9 || >= 7.6.0, < 7.6.7 || >= 8.0.0, < 8.0.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["email-gateway","fortiauthenticator","fortimail","fortinet","self-hosted","vendor"],"not_affected_if":["admin-interface-restricted","default-config","fortimail-cloud","managed-hosting","no-admin-access"],"how_to_check":"Run 'get system status' in the FortiMail CLI (or read the system dashboard) and compare the version: affected are 8.0.0-8.0.2, 7.6.0-7.6.6, 7.4.0-7.4.8 and all 7.2. Also list who holds admin or domain admin accounts on the administrative interface and whether a FortiAuthenticator is paired. Fortinet lists no virtual patch and no workaround; restricting admin interface access is general hardening only.","fix":"FortiMail 7.6: upgrade to 7.6.7 or above. 7.4: upgrade to 7.4.9 or above. 8.0: upgrade to 8.0.3 or above (Fortinet lists 8.0.3 as upcoming on Nov 10, 2026). 7.2: no fixed release, migrate to a fixed branch. FortiMail Cloud was already updated on Oct 5, 2026 (v7.6.7 or v8.0.2 GA); no action needed.","status":"open","published_at":"2026-11-11T22:17:15+00:00","first_seen_at":"2026-11-11T22:29:29+00:00","triaged_at":"2026-11-11T22:33:47+00:00","updated_at":"2026-11-11T22:46:44+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-11-11T22:33:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Fortinet FortiMail: argument injection lets admins run code as root","impact":"high","summary":"Fortinet FortiMail mail gateways fail to neutralize argument delimiters in a command, so a crafted HTTP request to the admin interface can pass extra arguments to a system command. An authenticated domain admin or admin can then run arbitrary code or CLI commands as root, read or write any file, and delete users of other tenant domains on a paired FortiAuthenticator.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortimail","fortiauthenticator","email-gateway","fortinet"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs code as root on the mail gateway.","analyst_note":"Fixed versions and Fortinet's advisory are not in the sources; check the Fortinet PSIRT advisory for the fixed builds and any workaround.","how_to_check":"- Check the FortiMail firmware version under the system dashboard or `get system status` in the CLI, and compare it with the affected ranges: `8.0.0` through `8.0.2`, `7.6.0` through `7.6.6`, `7.4.0` through `7.4.8`, and all `7.2` releases.\n- Check whether a FortiAuthenticator is paired with the FortiMail unit.\n- Check who holds domain admin or admin accounts on the administrative interface.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["admin-interface-restricted","default-config"],"who_is_affected":"Organizations running FortiMail 8.0.0 to 8.0.2, 7.6.0 to 7.6.6, 7.4.0 to 7.4.8, or any 7.2 release. The attacker must already hold domain admin or admin credentials and reach the administrative interface over HTTP, so exposure is reduced where that interface is limited to trusted networks. Units not on the listed versions are outside the stated range.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000832,"input_tokens":4660,"output_tokens":732,"severity_before":"high"},"analyst_status":"done","analyst_note":"Fixed versions and Fortinet's advisory are not in the sources; check the Fortinet PSIRT advisory for the fixed builds and any workaround.","search":"'-126169':13A,16A '-2026':12A,15A '7.2':116C '7.4.0':112C '7.4.8':114C '7.6.0':108C '7.6.6':110C '8.0.0':104C '8.0.2':106C 'admin':6A,47B,60B,62B,127C,129C 'administr':165C 'allow':120C 'arbitrari':66B,143C,148C,155C 'argument':3A,35B,52B,93C,98C 'attack':124C 'authent':58B,122C 'cli':69B,149C 'code':8A,67B,144C 'command':39B,56B,70B,97C,150C 'craft':42B,160C 'cve':11A,14A 'delet':79B,132C 'delimit':36B,94C 'domain':59B,84B,126C,137C 'email':19B 'email-gateway':18B 'execut':142C 'extra':51B 'fail':32B 'file':77B,156C 'fortiauthent':21B,88B,141C 'fortimail':2A,17A,22B,29B,103C,107C,111C,115C 'fortinet':1A,23B,28B,102C 'gateway':20B,31B 'host':26B 'http':43B,161C 'improp':90C 'inject':4A,99C 'interfac':48B,166C 'let':5A 'mail':30B 'may':119C 'neutral':34B,91C 'pair':87B,140C 'pass':50B 'privileg':130C 'read':73B,152C 'remot':123C 'request':44B,162C 'root':10A,72B,146C,158C 'run':7A,65B 'self':25B 'self-host':24B 'system':55B 'tenant':83B,136C 'user':80B,133C 'vendor':27B 'version':118C 'via':159C 'vulner':100C 'write':75B,154C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted FortiMail appliances and VMs on 8.0.0-8.0.2, 7.6.0-7.6.6, 7.4.0-7.4.8 or any 7.2. Exploitation needs an authenticated domain admin or admin account that sends crafted HTTP requests to the administrative interface. It can then run code as root, read or write files, and delete users of other tenant domains on a paired FortiAuthenticator. FortiMail Cloud customers can skip it, since Fortinet patched Cloud on Oct 5, 2026.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:46:41Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-218","run_id":3657},"how_to_check":{"at":"2026-11-11T22:46:41Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-218","run_id":3657},"who_affected":{"at":"2026-11-11T22:46:41Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-218","run_id":3657}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["fortimail"],"ptokens":["fortimail"],"labels":["emailgateway","fortiauthenticator","fortimail","fortinet","high","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126169':13A,16A '-2026':12A,15A 'admin':6A 'argument':3A 'code':8A 'cve':11A,14A 'fortimail':2A,17A 'fortinet':1A 'inject':4A 'let':5A 'root':10A 'run':7A","search_b":"'admin':47B,60B,62B 'arbitrari':66B 'argument':35B,52B 'authent':58B 'cli':69B 'code':67B 'command':39B,56B,70B 'craft':42B 'delet':79B 'delimit':36B 'domain':59B,84B 'email':19B 'email-gateway':18B 'extra':51B 'fail':32B 'file':77B 'fortiauthent':21B,88B 'fortimail':22B,29B 'fortinet':23B,28B 'gateway':20B,31B 'host':26B 'http':43B 'interfac':48B 'mail':30B 'neutral':34B 'pair':87B 'pass':50B 'read':73B 'request':44B 'root':72B 'run':65B 'self':25B 'self-host':24B 'system':55B 'tenant':83B 'user':80B 'vendor':27B 'write':75B","search_c":"'7.2':116C '7.4.0':112C '7.4.8':114C '7.6.0':108C '7.6.6':110C '8.0.0':104C '8.0.2':106C 'admin':127C,129C 'administr':165C 'allow':120C 'arbitrari':143C,148C,155C 'argument':93C,98C 'attack':124C 'authent':122C 'cli':149C 'code':144C 'command':97C,150C 'craft':160C 'delet':132C 'delimit':94C 'domain':126C,137C 'execut':142C 'file':156C 'fortiauthent':141C 'fortimail':103C,107C,111C,115C 'fortinet':102C 'http':161C 'improp':90C 'inject':99C 'interfac':166C 'may':119C 'neutral':91C 'pair':140C 'privileg':130C 'read':152C 'remot':123C 'request':162C 'root':146C,158C 'tenant':136C 'user':133C 'version':118C 'via':159C 'vulner':100C 'write':154C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126169","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126169","severity":null,"published_at":"2026-11-11T22:17:15+00:00","modified_at":"2026-11-11T22:17:15+00:00","first_seen_at":"2026-11-11T22:29:29+00:00","fetched_at":"2026-11-11T22:29:29+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126169:3657","url":"https://www.fortiguard.com/psirt/FG-IR-26-218","severity":null,"published_at":"2026-11-11T22:46:41+00:00","modified_at":"2026-11-11T22:46:44+00:00","first_seen_at":"2026-11-11T22:46:41+00:00","fetched_at":"2026-11-11T22:46:44+00:00","note":"Restating FortiMail as a single product row per PSIRT FG-IR-26-218.","cites":["https://www.fortiguard.com/psirt/FG-IR-26-218"]}],"documents":[{"id":129714,"url":"https://www.fortiguard.com/psirt/FG-IR-26-218","title":"Fortinet PSIRT FG-IR-26-218: FortiMail argument injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}