Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Fortinet | FortiMail | unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
Upgrade to FortiMail version 8.0.2 or above Upgrade to FortiMail version 7.6.7 or above
Tracking
Sign in to view the affected projects.
No advisories yet.
| Link | Providers |
|---|---|
| https://fortiguard.fortinet.com/psirt/FG-IR-26-200 |
|
Wed, 11 Nov 2026 21:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted HA join-request packets. | |
| First Time appeared |
Fortinet
Fortinet fortimail |
|
| Weaknesses | CWE-78 | |
| CPEs | cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:* |
|
| Vendors & Products |
Fortinet
Fortinet fortimail |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: fortinet
Published:
Updated: 2026-11-11T21:28:59.138Z
Reserved: 2026-11-10T20:03:25.970Z
Link: CVE-2026-126148
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')