Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-126148 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-12 |
| Vendor | Fortinet |
| Product | FortiMail |
| Vulnerability Type | OS command injection (CWE-78) |
| CVSS Score | 9.8 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
An improper neutralization of special elements used in an OS command (‘OS command injection’) vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1 and 7.6.0 through 7.6.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted HA join-request packets.
The attack abuses the mechanism for joining devices to a high-availability (HA) cluster. What matters is whether the HA interface is reachable by the attacker — it should run in an isolated segment.
Required Actions
- Update FortiMail to the version listed in Fortinet advisory FG-IR-26-200.
- Make sure HA interfaces and traffic run in a dedicated, isolated segment unreachable from the internet or user networks.
- Review FortiMail logs for unexpected attempts to join the HA cluster.
Who Is Affected?
The vulnerability affects Fortinet FortiMail 8.0.0–8.0.1 and 7.6.0–7.6.6. FortiMail is an email security gateway, typically exposed to the internet (SMTP, webmail) and used by enterprises and public institutions.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-126148 vulnerability?
CVE-2026-126148 is an OS command injection flaw (CWE-78) in Fortinet FortiMail that allows code or command execution via crafted HA join-request packets. CVSS score: 9.8.
Does exploiting CVE-2026-126148 require authentication?
No. The ability to send HA packets to the device is enough; the attack requires no authentication or user interaction.
How to protect against CVE-2026-126148?
Update FortiMail as per advisory FG-IR-26-200 and restrict access to the device interfaces.
Who is affected by CVE-2026-126148?
Organizations running FortiMail 7.6.0–7.6.6 or 8.0.0–8.0.1.
