Main Vulnerability Database Vulnerabilities #VU165198

OS Command Injection in FortiRecorder and FortiMail - CVE-2026-126146

Published: November 11, 2026

Vulnerability identifier: #VU165198

CSH Severity: Low

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-126146

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote privileged user to execute arbitrary code.

The vulnerability exists due to improper neutralization of special elements used in an os command ('os command injection'). An authenticated privileged attacker can execute unauthorized code or commands via a specifically crafted archive account configuration.

Affected software

FortiRecorder
FortiMail

How to mitigate CVE-2026-126146

Install update from vendor's website.

FortiRecorder - addressed in versions 7.0.7, 7.2.13, 7.6.3
FortiMail - addressed in versions 7.2.10, 7.4.7, 7.6.5, 8.0.2

External References

https://www.fortiguard.com/psirt/FG-IR-26-198

Related Security Bulletins