FortiMail OS command injection lets an admin run code as root
Original title: Improper neutralization of special elements used in an OS command
The attacker must already be an administrator with system-time read-write access; CVSSv3 is 7.2.
Fortinet PSIRT FG-IR-26-197 reports an OS command injection (CWE-78) in FortiMail, scored CVSSv3 7.2. An authenticated administrator with system-time read-write access may execute unauthorized code or commands as root. The advisory was revised on November 10, 2026. The snippet gives no version range or fix.
Unconfirmed: The snippet does not state affected versions, a fixed release, or known exploitation.
- Impact stated as unauthorized code or commands as root.
- Requires an authenticated administrator with system-time read-write access.
- CWE-78, CVSSv3 score 7.2, product FortiMail only in this notice.
- Revised on November 10, 2026; id FG-IR-26-197.
Impact: authenticated admin can execute code or commands as root
| Product | Affected |
|---|---|
| Fortinet FortiMail | — |
From the original article
CVSSv3 Score: 7. 2 An Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) vulnerability [CWE-78] in FortiMail may allow an authenticated administrator with system-time read-write access to execute unauthorized code or commands as root. Revised on 2026-11-10 00:00:00
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.