CVE-2026-126144

HighCVSS 8.8/10Last modified Nov 14, 2026

Description

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.4, FortiMail 7.4.0 through 7.4.6, FortiMail 7.2 all versions, FortiRecorder 7.6.0 through 7.6.2, FortiRecorder 7.2.0 through 7.2.12, FortiRecorder 7.0.0 through 7.0.6, FortiVoice 8.0.0 through 8.0.1, FortiVoice 7.4.0 through 7.4.2, FortiVoice 7.2.0 through 7.2.5, FortiVoice 7.0.0 through 7.0.8 may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
FortinetFortiMail>= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.4; >= 7.4.0, <= 7.4.6; >= 7.2.0, <= 7.2.9
FortinetFortiRecorder>= 7.6.0, <= 7.6.2; >= 7.2.0, <= 7.2.12; >= 7.0.0, <= 7.0.6
FortinetFortiVoice>= 8.0.0, <= 8.0.1; >= 7.4.0, <= 7.4.2; >= 7.2.0, <= 7.2.5; >= 7.0.0, <= 7.0.8

References

Timeline

Published
Nov 11, 2026
Last modified
Nov 14, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1261457.2A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 throuCVE-2026-1261467.2A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 throuCVE-2026-1261479.8A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FoCVE-2026-1261489.8A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 throuCVE-2026-1261497.5A integer overflow or wraparound vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 thrCVE-2026-1261509.1A weak password recovery mechanism for forgotten password vulnerability in Fortinet FortiMail 8.0.0, FortiMail 7.6.0 through 7.6.5, FortiMaiCVE-2026-1261517.5A incorrect implementation of authentication algorithm vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.CVE-2026-1261527.6A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FCVE-2026-1261537.5A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FoCVE-2026-1261547.5A out-of-bounds write vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8,CVE-2026-1261559.1A incorrect authorization vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.CVE-2026-1261569.1A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, F
CVE-2026-126144: High severity, CVSS 8.8 | Vulnix