CVE-2026-126167: 
Fortimail vulnerability analysis and mitigation

CVE-2026-126167 is a command injection vulnerability (CWE-77/CWE-88) in Fortinet FortiMail that allows an authenticated remote attacker with domain admin or admin privileges to execute arbitrary code as root, run arbitrary CLI commands, read or write arbitrary files as root, and delete users of other tenant domains on a paired FortiAuthenticator. The vulnerability affects FortiMail 8.0.0–8.0.2, 7.6.0–7.6.6, 7.4.0–7.4.8, and 7.2 all versions (7.2.0–7.2.9). It was published on November 10–11, 2026, and is part of a group of related CVEs (CVE-2026-126166 through CVE-2026-126169) addressed in Fortinet advisory FG-IR-26-218. The CVSS v3.1 base score is 7.2 (High) (Fortinet PSIRT).

The root cause is improper neutralization of argument delimiters in a command (CWE-88 / CWE-77 — Command Injection), where user-supplied input in crafted HTTP requests to the FortiMail administrative interface is not properly sanitized before being passed to underlying system commands. An authenticated attacker with domain admin or admin-level privileges can exploit this by sending specially crafted HTTP requests to the administrative interface, causing the system to interpret injected command delimiters or arguments as part of an OS-level command execution context. The attack vector is network-based, requires no user interaction, and has low attack complexity, but does require high privileges (authenticated admin or domain admin access). The vulnerability was internally discovered by Gwendal Guegniaud of the Fortinet Product Security team using the frontier AI model Claude Mythos (Fortinet PSIRT).

Successful exploitation allows an authenticated attacker to execute arbitrary code or CLI commands as root on the FortiMail appliance, read or write arbitrary files with root privileges, and delete users belonging to other tenant domains on a paired FortiAuthenticator — potentially impacting multi-tenant environments beyond the attacker's own domain. This results in full compromise of confidentiality, integrity, and availability of the affected FortiMail system, and may enable lateral movement to connected FortiAuthenticator infrastructure. The cross-tenant user deletion capability introduces a significant risk of service disruption and unauthorized access management in environments using FortiMail with FortiAuthenticator integration (Fortinet PSIRT).

As of the publication date, Fortinet has confirmed this vulnerability is not known to be exploited in the wild (Known Exploited: No). No public proof-of-concept exploit code has been identified in the available threat intelligence data. The EPSS score is reported as 0.0, indicating a currently low probability of exploitation in the near term. Exploitation requires authenticated access with domain admin or admin privileges, which limits the attack surface compared to unauthenticated vulnerabilities (Fortinet PSIRT, ENISA EUVD).

1. Reconnaissance: Identify FortiMail administrative interfaces exposed to the network (typically HTTPS on port 443) running affected versions (7.2.0–7.2.9, 7.4.0–7.4.8, 7.6.0–7.6.6, or 8.0.0–8.0.2) using network scanning tools or Shodan.
2. Credential Acquisition: Obtain valid domain admin or administrator credentials for the FortiMail administrative interface through phishing, credential stuffing, or other means.
3. Authentication: Log in to the FortiMail administrative web interface using the acquired credentials.
4. Craft Malicious HTTP Request: Construct a crafted HTTP request targeting an administrative interface endpoint that processes user-supplied input without adequate sanitization of command delimiters or argument separators.
5. Inject Command Payload: Embed OS command injection payloads (e.g., using shell metacharacters or argument delimiters) within the HTTP request parameters to cause the backend to execute arbitrary commands as root.
6. Achieve Objective: Leverage root-level code execution to read/write arbitrary files, execute CLI commands, establish persistence, or manipulate FortiAuthenticator user accounts across tenant domains (Fortinet PSIRT).

• Network: Unusual or unexpected HTTP/HTTPS POST requests to FortiMail administrative interface endpoints from unexpected source IPs or at unusual times; outbound connections from the FortiMail appliance to external IPs following admin interface activity.
• Logs: FortiMail administrative access logs showing authenticated sessions from unexpected IP addresses or geographic locations; log entries reflecting unexpected API calls or administrative actions (e.g., cross-tenant user deletions on FortiAuthenticator).
• File System: Unexpected new files or modified system files on the FortiMail appliance, particularly in sensitive directories; unauthorized changes to configuration files readable/writable as root.
• Process: Unexpected child processes spawned from the FortiMail web server or administrative daemon (e.g., shell processes, network utilities like curl, wget, or nc); unusual root-level process activity on the appliance.

Fortinet has released patched versions to address this vulnerability. Administrators should upgrade to the following fixed releases as soon as possible:

• FortiMail 8.0: Upgrade to 8.0.3 or above
• FortiMail 7.6: Upgrade to 7.6.7 or above
• FortiMail 7.4: Upgrade to 7.4.9 or above
• FortiMail 7.2: Migrate to a fixed release (all 7.2.x versions are affected with no patch in-branch)

Fortinet Cloud customers do not need to take action, as FortiMail Cloud was remediated on October 5, 2026 by updating all firmware to v7.6.7 GA or v8.0.2 GA. As a general workaround, restrict administrative interface access to trusted IP addresses only and enforce the principle of least privilege for admin accounts (Fortinet PSIRT).

The vulnerability was internally discovered and reported by Gwendal Guegniaud of the Fortinet Product Security team, with the notable distinction of being identified with the assistance of the frontier AI model Claude Mythos — highlighting an emerging trend of AI-assisted vulnerability research within vendor security teams. The advisory was picked up by AUSCERT (ESB-2026.14308) and tracked by VulDB (vuln/436023) shortly after publication. No significant independent researcher commentary or broad social media discussion has been identified in the available data (Fortinet PSIRT).