---
id: "CVE-2026-126169"
page: "https://infrastack.ai/live/CVE-2026-126169"
kind: "vulnerability"
aliases: ["CVE-2026-126169"]
title: "Fortinet FortiMail: argument injection lets admins run code as root"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "FortiMail", "fixed": ["7.4.9", "7.6.7", "8.0.3"], "affected": ">= 7.2.0, < 7.4.9 || >= 7.6.0, < 7.6.7 || >= 8.0.0, < 8.0.3", "ecosystem": "vendor"}]
ecosystems: []
tags: ["email-gateway", "fortiauthenticator", "fortimail", "fortinet", "self-hosted", "vendor"]
not_affected_if: ["admin-interface-restricted", "default-config", "fortimail-cloud", "managed-hosting", "no-admin-access"]
published_at: "2026-11-11T22:17:15+00:00"
first_seen_at: "2026-11-11T22:29:29+00:00"
updated_at: "2026-11-11T22:46:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126169", "first_seen_at": "2026-11-11T22:29:29+00:00"}, {"source": "analyst", "url": "https://www.fortiguard.com/psirt/FG-IR-26-218", "first_seen_at": "2026-11-11T22:46:41+00:00", "cites": ["https://www.fortiguard.com/psirt/FG-IR-26-218"]}]
exploit_sources: []
---

# Fortinet FortiMail: argument injection lets admins run code as root

Link for people: https://infrastack.ai/live/CVE-2026-126169 (this .md is for agents)

Fortinet FortiMail mail gateways fail to neutralize argument delimiters in a command, so a crafted HTTP request to the admin interface can pass extra arguments to a system command. An authenticated domain admin or admin can then run arbitrary code or CLI commands as root, read or write any file, and delete users of other tenant domains on a paired FortiAuthenticator.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiMail affected >= 7.2.0, < 7.4.9 || >= 7.6.0, < 7.6.7 || >= 8.0.0, < 8.0.3 fixed 7.4.9, 7.6.7, 8.0.3

## How to check

Run 'get system status' in the FortiMail CLI (or read the system dashboard) and compare the version: affected are 8.0.0-8.0.2, 7.6.0-7.6.6, 7.4.0-7.4.8 and all 7.2. Also list who holds admin or domain admin accounts on the administrative interface and whether a FortiAuthenticator is paired. Fortinet lists no virtual patch and no workaround; restricting admin interface access is general hardening only.

## Fix

FortiMail 7.6: upgrade to 7.6.7 or above. 7.4: upgrade to 7.4.9 or above. 8.0: upgrade to 8.0.3 or above (Fortinet lists 8.0.3 as upcoming on Nov 10, 2026). 7.2: no fixed release, migrate to a fixed branch. FortiMail Cloud was already updated on Oct 5, 2026 (v7.6.7 or v8.0.2 GA); no action needed.

## Timeline

- 2026-11-11T22:29:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126169
- 2026-11-11T22:46:41+00:00 analyst https://www.fortiguard.com/psirt/FG-IR-26-218 — Restating FortiMail as a single product row per PSIRT FG-IR-26-218.

## Documents

- [advisory] Fortinet PSIRT FG-IR-26-218: FortiMail argument injection https://www.fortiguard.com/psirt/FG-IR-26-218

## From the sources

A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_