SB2026111178 - Multiple vulnerabilities in FortiMail

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026111178

SB2026111178 - Multiple vulnerabilities in FortiMail

Published: November 11, 2026

Security Bulletin ID SB2026111178
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Argument injection (CVE-ID: CVE-2026-126169)

CWE-ID: CWE-88 - Argument Injection or Modification

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to #BASIC_IMPACT#.

The vulnerability exists due to argument injection or modification in a command. An authenticated remote attacker with domain admin or admin privileges can delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface.


2) Argument injection (CVE-ID: CVE-2026-126168)

CWE-ID: CWE-88 - Argument Injection or Modification

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to #BASIC_IMPACT#.

The vulnerability exists due to argument injection or modification in a command. An authenticated remote attacker with domain admin or admin privileges can delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface.


3) Argument injection (CVE-ID: CVE-2026-126167)

CWE-ID: CWE-88 - Argument Injection or Modification

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to #BASIC_IMPACT#.

The vulnerability exists due to argument injection or modification in a command. An authenticated remote attacker with domain admin or admin privileges can delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface.


4) Argument injection (CVE-ID: CVE-2026-126166)

CWE-ID: CWE-88 - Argument Injection or Modification

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to #BASIC_IMPACT#.

The vulnerability exists due to argument injection or modification in a command. An authenticated remote attacker with domain admin or admin privileges can delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface.


Remediation

Install update from vendor's website.

References