CVE-2026-126168: 
Fortimail vulnerability analysis and mitigation

CVE-2026-126168 is an argument injection vulnerability (CWE-88) in Fortinet FortiMail that allows an authenticated remote attacker with domain admin or admin privileges to execute arbitrary code as root, run arbitrary CLI commands, read or write arbitrary files as root, and delete users of other tenant domains on a paired FortiAuthenticator. The vulnerability affects FortiMail 8.0.0–8.0.2, 7.6.0–7.6.6, 7.4.0–7.4.8, and 7.2 all versions (7.2.0–7.2.9). It was published on November 10–11, 2026, and is one of four related CVEs (CVE-2026-126166 through CVE-2026-126169) disclosed under Fortinet advisory FG-IR-26-218. The CVSS v3.1 base score is 7.2 (High) (Fortinet PSIRT).

The root cause is improper neutralization of argument delimiters in a command (CWE-88 — Argument Injection), where user-supplied input passed to the FortiMail administrative interface is not properly sanitized before being incorporated into system commands. An authenticated attacker with domain admin or admin-level privileges can craft malicious HTTP requests to the administrative interface that inject additional arguments into underlying commands, enabling code execution as root, arbitrary CLI command execution, and arbitrary file read/write. The vulnerability also extends to cross-tenant impact, allowing manipulation of user accounts on a paired FortiAuthenticator belonging to other tenant domains. The vulnerability was internally discovered by Gwendal Guegniaud of the Fortinet Product Security team using the frontier AI model Claude Mythos (Fortinet PSIRT).

Successful exploitation grants an attacker root-level code execution on the FortiMail appliance, enabling complete system compromise including arbitrary file read and write, execution of CLI commands, and potential persistence. The cross-tenant impact is particularly significant in multi-tenant deployments: a domain admin of one tenant can delete users from other tenant domains on a paired FortiAuthenticator, undermining authentication infrastructure integrity across the environment. This combination of confidentiality, integrity, and availability impacts — all rated High — creates risk of lateral movement into connected systems and disruption of email security services (Fortinet PSIRT).

As of the disclosure date, there is no evidence of in-the-wild exploitation, no public proof-of-concept code, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Fortinet explicitly states "Known Exploited: No" in the advisory. The EPSS score is 0.0, reflecting low current exploitation probability. Exploitation requires authenticated access with domain admin or admin privileges, which meaningfully limits the attack surface compared to unauthenticated vulnerabilities (Fortinet PSIRT).

1. Reconnaissance: Identify FortiMail administrative interfaces exposed to the network running affected versions (8.0.0–8.0.2, 7.6.0–7.6.6, 7.4.0–7.4.8, or 7.2.x). Tools such as Shodan or Censys can be used to locate internet-facing FortiMail instances.
2. Obtain credentials: Acquire domain admin or admin-level credentials through phishing, credential stuffing, or insider access — exploitation requires authenticated access.
3. Craft malicious HTTP request: Construct a crafted HTTP request targeting the FortiMail administrative interface that includes argument delimiter characters (e.g., spaces, dashes, or other shell metacharacters) in parameters that are passed to underlying system commands.
4. Inject arguments: The injected delimiters cause the application to pass attacker-controlled arguments to system-level commands, bypassing intended restrictions.
5. Achieve root execution: Depending on the targeted endpoint, the attacker can execute arbitrary code or CLI commands as root, read or write arbitrary files, or issue API calls to a paired FortiAuthenticator to delete users in other tenant domains (Fortinet PSIRT).

• Network: Unusual or unexpected HTTP POST/GET requests to FortiMail administrative interface endpoints from authenticated sessions, particularly with anomalous parameter values containing shell metacharacters or argument delimiters.
• Logs: FortiMail administrative audit logs showing unexpected CLI command execution or file access operations initiated via the GUI component; authentication events from domain admin accounts at unusual times or from unexpected source IPs.
• File System: Unexpected new files or modified system files on the FortiMail appliance; web shells or backdoors placed in accessible directories via the arbitrary file write capability.
• FortiAuthenticator: Unexpected user deletion events in FortiAuthenticator logs, particularly for users belonging to tenant domains other than the one managed by the acting admin account.
• Process: Unexpected child processes spawned with root privileges from the FortiMail web service process (Fortinet PSIRT).

Fortinet has released patched versions and recommends upgrading immediately: FortiMail 8.0.x users should upgrade to 8.0.3 or above (upcoming release); FortiMail 7.6.x users should upgrade to 7.6.7 or above; FortiMail 7.4.x users should upgrade to 7.4.9 or above; FortiMail 7.2.x users (all versions affected) should migrate to a fixed release. FortiMail Cloud customers do not need to take action, as Fortinet remediated the issue on October 5, 2026 by updating all cloud instances to v7.6.7 GA or v8.0.2 GA. As an interim measure, restrict administrative interface access to trusted IP addresses and enforce least-privilege principles to limit exposure to accounts with domain admin or admin roles (Fortinet PSIRT).

The vulnerability was internally discovered and reported by Gwendal Guegniaud of the Fortinet Product Security team, with Fortinet noting the use of the frontier AI model Claude Mythos in the discovery process — a notable acknowledgment of AI-assisted vulnerability research. The advisory was picked up by AUSCERT (ESB-2026.14308) and aggregated by VulDB and cve.report shortly after publication. No significant independent researcher commentary or broad social media discussion has been identified at this time (Fortinet PSIRT).