Critical OS Command Injection Vulnerability in Fortinet FortiMail

## Overview Fortinet disclosed a critical vulnerability in FortiMail, tracked as CVE-2026-126148. This flaw affects FortiMail versions 8.0.0 through 8.0.1 and 7.6.0 through 7.6.6. It involves improper neutralization of special elements used in OS commands, leading to OS command injection. ## Technical Details The vulnerability allows unauthenticated attackers to execute unauthorized code or commands. This can be done via crafted HA join-request packets. The CVSS score for this vulnerability is 9.8, indicating a high severity level. Attackers can exploit this flaw without needing valid credentials, increasing the risk to affected systems. ## Impact Successful exploitation of CVE-2026-126148 can lead to unauthorized access and control over the affected FortiMail systems. This could result in data breaches, service disruptions, or further attacks within the network. Organizations using vulnerable versions of FortiMail should prioritize addressing this issue to mitigate risks. ## Mitigation Fortinet recommends that users upgrade to the latest versions of FortiMail to protect against this vulnerability. Regularly applying security updates and patches is critical. Additionally, organizations should monitor their systems for any unusual activity that may indicate exploitation attempts.