RCE in Fortinet Fortimail

CVE-2026-126148

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted HA join-request packets.

Vulnerability class: Command Injection (OS Command Injection)

Published 2026-11-11 · last modified 2026-11-12.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

FIRST.org has not scored this CVE yet. About EPSS.

Affected products

Fortinet Fortimail

Weakness classification (CWE)

CWE-78 — OS Command Injection

Public exploits and proof-of-concept code

1 public repository with exploit or proof-of-concept code for this CVE:

googlesky/CVE-2026-126148 (last pushed 2026-11-12): Containerised PoC for CVE-2026-126148 (Fortinet FG-IR-26-200): an OS command injection (CWE-78) in the FortiMail HA cluster lets one unauthenticated join-request packet reach command execution as roo…

References

fortiguard.fortinet.com/psirt/FG-IR-26-200

This CVE has public exploit evidence. See the latest CVEs with public exploits.