Unauthenticated FortiMail command injection rated CVSS 9.8
Original title: Improper neutralization of special elements used in an os command
Crafted HA join-request packets can run unauthorized commands; no CVE or versions are named.
Fortinet PSIRT revised FG-IR-26-200 on November 10, a command injection flaw (CWE-77) in FortiMail. An unauthenticated attacker may execute unauthorized code or commands through crafted HA join-request packets. Fortinet assigns a CVSSv3 score of 9.8. The snippet does not list versions, a fix, a CVE, or exploitation.
Unconfirmed: The snippet does not state versions, a fix, a CVE, or whether attacks have occurred.
- The advisory identifier is FG-IR-26-200.
- The weakness is classified as CWE-77, not CWE-78.
- No authentication is required.
- The input is crafted HA join-request packets.
Impact: unauthenticated attacker can execute unauthorized code or commands
| Product | Affected |
|---|---|
| Fortinet FortiMail | — |
From the original article
CVSSv3 Score: 9. 8 An Improper neutralization of special elements used in a command ('command injection') [CWE-77] in FortiMail may allow an unauthenticated attacker to execute unauthorized code or commands via crafted HA join-request packets. Revised on 2026-11-10 00:00:00
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.