FortiMail, FortiRecorder and FortiVoice OS command injection scores 8.8
Original title: Improper neutralization of special elements used in an OS command in webmail
An authenticated attacker can run unauthorized code or commands through crafted HTTP requests.
Fortinet PSIRT reports an OS command injection vulnerability in FortiMail, FortiRecorder and FortiVoice. Scored CVSSv3 8.8 and tracked as FG-IR-26-196, it may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests. The advisory was revised on November 10, 2026. No versions, patch, CVE id or exploitation status appear in the snippet.
Unconfirmed: Affected versions, a fixed release, a CVE id and exploitation status are not stated.
- CVSSv3 score is 8.8; the weakness is CWE-78.
- The stated vector is crafted HTTP requests.
- Affected products are FortiMail, FortiRecorder and FortiVoice.
- The advisory was revised on November 10, 2026.
Impact: Authenticated unauthorized code or command execution
| Product | Affected |
|---|---|
| Fortinet FortiMail | — |
| Fortinet FortiRecorder | — |
| Fortinet FortiVoice | — |
- Vendors
- Fortinet
- Products
- FortiMailFortiRecorderFortiVoice
From the original article
CVSSv3 Score: 8. 8 An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiMail, FortiRecorder and FortiVoice may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests. Revised on 2026-11-10 00:00:00
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.