EUVD-2026-123820

A improper neutralization of special elements used in an os command 'os command injection' vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted HA join-request packets...

CVE-2026-126148

A improper neutralization of special elements used in an os command 'os command injection' vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted HA join-request packets...

CVE-2026-126148

A improper neutralization of special elements used in an os command 'os command injection' vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted HA join-request packets...

CVE-2026-126148

Fortinet FortiMail versions 8.0.0 through 8.0.1 and 7.6.0 through 7.6.6 are vulnerable to an OS command injection (CWE-77/CWE-78) flaw. The root cause is the improper neutralization of special elements used in a command, which may allow an unauthenticated attacker to execute unauthorized code or ...

CVE-2026-126148: Fortinet FortiMail: A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet…

A improper neutralization of special elements used in an os command 'os command injection' vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted HA join-request packets...

Improper neutralization of special elements used in an os command

An Improper neutralization of special elements used in a command 'command injection' CWE-77 in FortiMail may allow an unauthenticated attacker to execute unauthorized code or commands via crafted HA join-request packets...