FortiMail OS command injection lets authenticated admins run code as root
Original title: Improper neutralization of special elements used in an os command
FG-IR-26-210 is scored 7.2 and is triggered by specially crafted HTTP requests.
Fortinet PSIRT revised FG-IR-26-210 on November 10, an OS command injection flaw (CWE-78) in FortiMail. An authenticated administrator may execute unauthorized code or commands as root through specially crafted HTTP requests. The notice gives a CVSSv3 score of 7.2 and does not name versions, a fix, or a CVE.
Unconfirmed: Affected versions, a fix, a CVE, and exploitation status are not stated.
- Successful use yields command execution as root.
- The attack path is specially crafted HTTP requests.
- The weakness is classified as CWE-78.
- No patch version is stated in the snippet.
Impact: authenticated administrator can run code or commands as root
| Product | Affected |
|---|---|
| Fortinet FortiMail | — |
From the original article
CVSSv3 Score: 7. 2 An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiMail may allow an authenticated administrator to execute unauthorized code or commands as root via specially crafted HTTP requests. Revised on 2026-11-10 00:00:00
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.