Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-126147 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-12 |
| Vendor | Fortinet |
| Product | FortiMail |
| Vulnerability Type | path traversal (CWE-22) |
| CVSS Score | 9.8 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
An improper limitation of a pathname to a restricted directory (‘path traversal’) vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8 and 7.2 all versions may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.
The attack requires no authentication or user interaction and results in code execution on the mail gateway — i.e. takeover of the device all corporate mail passes through.
Required Actions
- Update FortiMail to the version listed in Fortinet advisory FG-IR-26-199.
- Restrict access to the FortiMail administrative interface to the management network or a list of trusted addresses.
- Review FortiMail logs for requests containing
../sequences and for unexpected files or processes.
Who Is Affected?
The vulnerability affects Fortinet FortiMail 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8 and all 7.2 versions. FortiMail is an email security gateway, typically exposed to the internet (SMTP, webmail) and used by enterprises and public institutions.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-126147 vulnerability?
CVE-2026-126147 is a path traversal flaw (CWE-22) in Fortinet FortiMail that allows an unauthenticated attacker to execute code or commands. CVSS score: 9.8.
Does exploiting CVE-2026-126147 require authentication?
No. The attack requires no authentication or user interaction.
How to protect against CVE-2026-126147?
Update FortiMail as per advisory FG-IR-26-199 and restrict access to the device interfaces.
Who is affected by CVE-2026-126147?
Organizations running FortiMail 7.2–8.0.1.
