FortiMail and FortiRecorder OS command injection rated CVSS 7.2
Original title: Improper neutralization of special elements used in an OS command
A privileged authenticated attacker can run code or commands through a crafted archive account configuration.
Fortinet PSIRT FG-IR-26-198 reports an OS command injection (CWE-78) in FortiMail and FortiRecorder, scored CVSSv3 7.2. An authenticated privileged attacker may execute unauthorized code or commands via a specifically crafted archive account configuration. The advisory was revised on November 10, 2026. No affected versions or fixes appear in the snippet.
Unconfirmed: The snippet does not state affected versions, fixed versions, or whether the flaw is exploited.
- CWE-78 OS command injection, CVSSv3 score 7.2.
- Vector described as a crafted archive account configuration.
- Attacker must already be authenticated and privileged.
- Revised on November 10, 2026; id FG-IR-26-198.
Impact: privileged authenticated attacker can execute unauthorized code or commands
| Product | Affected |
|---|---|
| Fortinet FortiMail | — |
| Fortinet FortiRecorder | — |
- Vendors
- Fortinet
- Products
- FortiMailFortiRecorder
From the original article
CVSSv3 Score: 7. 2 An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiMail, FortiRecorder may allow an authenticated privileged attacker to execute unauthorized code or commands via a specifically crafted archive account configuration. Revised on 2026-11-10 00:00:00
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.