CVE-2026-126169: 
Fortimail vulnerability analysis and mitigation

CVE-2026-126169 is an argument injection vulnerability (CWE-88) in Fortinet FortiMail that allows an authenticated remote attacker with domain admin or admin privileges to execute arbitrary code as root, run arbitrary CLI commands, read or write arbitrary files as root, and delete users of other tenant domains on a paired FortiAuthenticator. The vulnerability affects FortiMail 8.0.0–8.0.2, 7.6.0–7.6.6, 7.4.0–7.4.8, and 7.2 all versions. It was published on November 10–11, 2026, and is one of four CVEs (CVE-2026-126166 through CVE-2026-126169) addressed under Fortinet advisory FG-IR-26-218. The CVSS v3.1 base score is 7.2 (High) (Fortinet PSIRT, Feedly).

The root cause is improper neutralization of argument delimiters in a command (CWE-88), where user-supplied input passed to the FortiMail administrative interface is not properly sanitized before being incorporated into system commands. An authenticated attacker with domain admin or admin-level privileges can craft malicious HTTP requests to the administrative interface that inject additional arguments into underlying commands, enabling arbitrary code execution as root, arbitrary CLI command execution, and arbitrary file read/write operations. The vulnerability also enables cross-tenant privilege abuse by allowing deletion of users belonging to other tenant domains on a paired FortiAuthenticator. The vulnerability was internally discovered by Gwendal Guegniaud of the Fortinet Product Security team using the Claude Mythos AI model (Fortinet PSIRT).

Successful exploitation grants an attacker root-level code execution on the FortiMail appliance, enabling complete system compromise including arbitrary file read/write, arbitrary CLI command execution, and potential lateral movement to paired FortiAuthenticator infrastructure. The cross-tenant impact is particularly significant in multi-tenant deployments, as a domain admin of one tenant could delete users belonging to other tenant domains on a paired FortiAuthenticator, disrupting authentication services across the organization. Confidentiality, integrity, and availability are all rated HIGH, reflecting the full scope of potential damage (Fortinet PSIRT).

As of the publication date, Fortinet has confirmed this vulnerability is not known to be exploited in the wild, and no public proof-of-concept exploit code has been identified. Exploitation requires authentication with domain admin or admin privileges, which limits the attack surface compared to unauthenticated vulnerabilities. The EPSS score is reported as 0.0, and the vulnerability is not listed in the CISA KEV catalog (Fortinet PSIRT, Feedly).

1. Reconnaissance: Identify FortiMail administrative interfaces exposed to the network running affected versions (8.0.0–8.0.2, 7.6.0–7.6.6, 7.4.0–7.4.8, or 7.2.x).
2. Authentication: Obtain or compromise domain admin or administrator credentials for the FortiMail administrative interface (e.g., through phishing, credential stuffing, or insider access).
3. Craft malicious HTTP request: Construct a crafted HTTP request targeting the FortiMail administrative interface that includes injected argument delimiters (e.g., special characters such as spaces, dashes, or shell metacharacters) within parameters that are passed to underlying system commands.
4. Argument injection: Submit the crafted request so that the injected arguments alter the behavior of the underlying command executed by FortiMail, appending attacker-controlled arguments (e.g., to write files, execute shell commands, or invoke CLI operations).
5. Achieve root code execution: Leverage the injected arguments to execute arbitrary commands as root, read/write sensitive files, or issue CLI commands — potentially establishing persistence or pivoting to the paired FortiAuthenticator to manipulate user accounts across tenant domains (Fortinet PSIRT).

• Network: Unusual or anomalous HTTP POST/GET requests to the FortiMail administrative interface from unexpected source IPs or at unusual times; requests containing special characters or argument delimiters in administrative API parameters.
• Logs: FortiMail administrative audit logs showing unexpected administrative actions (e.g., user deletions on FortiAuthenticator, file operations, or CLI command executions) by domain admin accounts; error messages related to command execution in system logs.
• File System: Unexpected new files or modified system files on the FortiMail appliance, particularly in directories accessible as root; presence of web shells or unauthorized scripts.
• Process: Unusual child processes spawned from FortiMail web/admin service processes (e.g., shell interpreters, file transfer utilities); unexpected outbound network connections from the FortiMail appliance.
• FortiAuthenticator: Unexpected user deletions or account modifications on a paired FortiAuthenticator, particularly affecting users from tenant domains not managed by the acting admin account (Fortinet PSIRT).

Fortinet has released patched versions to address this vulnerability: upgrade FortiMail 8.0.x to 8.0.3 or above, FortiMail 7.6.x to 7.6.7 or above, and FortiMail 7.4.x to 7.4.9 or above. FortiMail 7.2 (all versions) is not receiving a fix in-branch and users should migrate to a fixed release. FortiMail Cloud customers do not need to take action, as Fortinet remediated the issue on October 5, 2026 by updating all cloud instances to v7.6.7 GA or v8.0.2 GA. As an interim measure, restrict administrative interface access to trusted IP addresses and enforce least-privilege principles for admin accounts (Fortinet PSIRT).

The vulnerability was internally discovered and reported by Fortinet's own Product Security team, with Fortinet noting the use of the frontier AI model Claude Mythos in the discovery process — a notable acknowledgment of AI-assisted vulnerability research. The advisory was picked up by AUSCERT and tracked in VulDB shortly after publication, indicating standard industry monitoring. No significant independent researcher commentary or broad social media discussion has been identified at this time (Fortinet PSIRT, AUSCERT).