A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1 may allow an authenticated administrator to execute unauthorized code or commands as root via specially crafted HTTP requests.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Fortinet | FortiMail | unaffected |
|
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
Upgrade to FortiMail version 8.0.2 or above
Workaround
No workaround given by the vendor.
References
| Link | Providers |
|---|---|
| https://fortiguard.fortinet.com/psirt/FG-IR-26-210 |
|
History
Wed, 11 Nov 2026 21:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1 may allow an authenticated administrator to execute unauthorized code or commands as root via specially crafted HTTP requests. | |
| First Time appeared |
Fortinet
Fortinet fortimail |
|
| Weaknesses | CWE-78 | |
| CPEs | cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:* |
|
| Vendors & Products |
Fortinet
Fortinet fortimail |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: fortinet
Published:
Updated: 2026-11-11T21:29:12.696Z
Reserved: 2026-11-10T20:03:44.611Z
Link: CVE-2026-126158
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses