CVE-2026-126166: 
Fortimail vulnerability analysis and mitigation

CVE-2026-126166 is an argument injection vulnerability (CWE-88) in Fortinet FortiMail that allows an authenticated remote attacker with domain admin or admin privileges to execute arbitrary code as root, run arbitrary CLI commands, read or write arbitrary files as root, and delete users of other tenant domains on a paired FortiAuthenticator. The vulnerability affects FortiMail 8.0.0–8.0.2, 7.6.0–7.6.6, 7.4.0–7.4.8, and 7.2 all versions. It was published on November 10–11, 2026, and was internally discovered by Fortinet's Product Security team. The CVSS v3.1 base score is 7.2 (High) per NVD, while Fortinet's advisory lists a CVSSv3 score of 7.6 (High) (Fortinet PSIRT).

The root cause is improper neutralization of argument delimiters in a command (CWE-88), where user-supplied input passed to the FortiMail administrative interface is not properly sanitized before being used in command construction. An authenticated attacker with domain admin or admin-level privileges can send crafted HTTP requests to the administrative interface to inject additional arguments into underlying commands, achieving code execution as root, arbitrary CLI command execution, or arbitrary file read/write. The vulnerability also enables cross-tenant impact by allowing deletion of users on a paired FortiAuthenticator belonging to other tenant domains. The attack vector is network-based, requires no user interaction, but does require high privileges (domain admin or admin) (Fortinet PSIRT).

Successful exploitation grants an attacker root-level code execution on the FortiMail appliance, enabling complete system compromise including arbitrary file read and write, execution of arbitrary CLI commands, and potential lateral movement to paired FortiAuthenticator infrastructure. The cross-tenant impact — the ability to delete users of other tenant domains on a paired FortiAuthenticator — poses a significant availability and integrity risk in multi-tenant deployments. Confidentiality, integrity, and availability are all rated as HIGH impact (Fortinet PSIRT).

As of the publication date, there is no evidence of in-the-wild exploitation, no public proof-of-concept code, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.0, indicating a currently low probability of exploitation in the near term. Exploitation requires authenticated access with domain admin or admin privileges, which limits the attack surface compared to unauthenticated vulnerabilities. The vulnerability was internally discovered by Fortinet's Product Security team using the Claude Mythos AI model (Fortinet PSIRT).

1. Obtain Credentials: Acquire domain admin or admin-level credentials for the target FortiMail administrative interface through phishing, credential stuffing, or insider access.
2. Access Administrative Interface: Authenticate to the FortiMail web-based administrative interface over HTTPS.
3. Craft Malicious HTTP Request: Construct an HTTP request targeting a vulnerable administrative endpoint, injecting argument delimiters (e.g., spaces, special characters) into a parameter that is passed unsanitized to an underlying system command.
4. Inject Payload: Include a crafted payload that appends additional arguments or commands to the underlying command execution context, such as appending shell commands after a delimiter.
5. Achieve Root Execution: The injected arguments are processed by the system as root, enabling arbitrary code execution, CLI command execution, file read/write, or deletion of FortiAuthenticator users in other tenant domains (Fortinet PSIRT).

• Logs: Unusual or unexpected CLI commands appearing in FortiMail administrative audit logs, particularly those originating from authenticated admin sessions; log entries showing access to administrative API endpoints with anomalous parameter values.
• File System: Unexpected new files or modifications to system files on the FortiMail appliance, especially in directories accessible only to root; unauthorized scripts or binaries placed on the system.
• Network: Unexpected outbound connections from the FortiMail appliance to external IPs following administrative interface access; unusual API calls from the FortiMail appliance to a paired FortiAuthenticator, particularly user deletion events.
• Process: Unexpected processes spawned with root privileges from the FortiMail web service process; shell processes (e.g., /bin/sh, /bin/bash) launched as children of the FortiMail GUI service.

Fortinet has released patched versions to address this vulnerability. Users should upgrade to the following fixed releases: FortiMail 8.0.3 or above (for 8.0.x), FortiMail 7.6.7 or above (for 7.6.x), FortiMail 7.4.9 or above (for 7.4.x), and users on FortiMail 7.2 (all versions) should migrate to a fixed release. FortiMail Cloud customers do not need to take action, as Fortinet remediated the issue on October 5, 2026 by updating all cloud instances to v7.6.7 GA or v8.0.2 GA. As a general hardening measure, restrict administrative interface access to trusted IP addresses and enforce the principle of least privilege for admin accounts (Fortinet PSIRT).

The vulnerability was internally discovered and reported by Gwendal Guegniaud of the Fortinet Product Security team, notably with the assistance of the frontier AI model Claude Mythos, highlighting the growing role of AI in internal security research. Fortinet published the advisory on November 10, 2026 under FG-IR-26-218. No significant external researcher commentary or broad media coverage has been identified at this time (Fortinet PSIRT).