A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1 may allow an authenticated administrator to execute unauthorized code or commands as root via specially crafted HTTP requests.
Metrics
Affected Vendors & Products
Advisories
No advisories yet.
Fixes
Solution
Upgrade to FortiMail version 8.0.2 or above
Workaround
No workaround given by the vendor.
References
| Link | Providers |
|---|---|
| https://fortiguard.fortinet.com/psirt/FG-IR-26-210 |
|
History
Wed, 11 Nov 2026 21:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1 may allow an authenticated administrator to execute unauthorized code or commands as root via specially crafted HTTP requests. | |
| First Time appeared |
Fortinet
Fortinet fortimail |
|
| Weaknesses | CWE-78 | |
| CPEs | cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:* |
|
| Vendors & Products |
Fortinet
Fortinet fortimail |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: fortinet
Published:
Updated: 2026-11-11T21:29:12.696Z
Reserved: 2026-11-10T20:03:44.611Z
Link: CVE-2026-126158
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses