Fortinet Products Vulnerable to OS Command Injection via Webmail

Fortinet has released security advisories detailing a critical OS Command Injection vulnerability (CWE-78) present in several of its products, including FortiMail, FortiRecorder, and FortiVoice. The vulnerability, identified under the advisory code FG-IR-26-196, carries a high CVSSv3 score of 8.8, indicating a significant risk to affected systems.

This flaw stems from the improper neutralization of special elements within OS commands processed by the webmail interface of the vulnerable products. An authenticated attacker who can access the webmail functionality can exploit this weakness by sending specially crafted HTTP requests. Successful exploitation allows the attacker to execute arbitrary code or commands on the underlying operating system of the affected Fortinet device.

The potential impact of this vulnerability is severe, as it could lead to a complete compromise of the affected devices. Attackers could use the gained access to exfiltrate sensitive data, disrupt services, or pivot to other systems within the network. The ability to execute arbitrary commands means that an attacker could potentially install malware, modify system configurations, or establish persistent access.

Fortinet has provided a comprehensive list of affected versions for each product. For FortiMail, versions ranging from 7.2.0 up to 8.0.0 are impacted, with specific patch levels noted for the 7.6 and 7.4 branches. FortiRecorder versions from 7.0.0 through 7.6.2 are also vulnerable, as are FortiVoice versions from 7.0.0 up to 8.0.1. Users are strongly advised to consult the specific advisory for their product to identify the exact versions and recommended upgrade paths.

The vulnerability was discovered internally by Sam Mckee of the Fortinet Product Security team, with assistance from the frontier AI model Claude Mythos. This internal discovery highlights the ongoing efforts by vendors to proactively identify and address security weaknesses before they can be exploited by malicious actors.

While the advisory does not explicitly mention if this vulnerability is being actively exploited in the wild, its critical nature and the CVSS score of 8.8 warrant immediate attention. Organizations using any of the affected Fortinet products should prioritize applying the available patches or implementing mitigating controls as outlined in the Fortinet advisories. The lack of specific mitigation details in the advisory suggests that patching is the primary recommended course of action.

This discovery underscores the importance of secure coding practices, particularly in handling user-supplied input within web applications. Command injection vulnerabilities remain a persistent threat, and vendors must remain vigilant in their security testing and patching processes to protect their customers from such attacks. The involvement of AI in the discovery process also points to the evolving landscape of vulnerability research.

This advisory specifically details CVE-2026-126146, an OS command injection vulnerability affecting numerous versions of FortiMail and FortiRecorder products. The flaw can be exploited by an authenticated privileged attacker through a crafted archive account configuration to execute unauthorized code or commands.

This advisory details an OS Command Injection vulnerability (CWE-78) affecting FortiManager, FortiAnalyzer, and their cloud variants, allowing authenticated attackers to execute arbitrary code via crafted HTTP requests to the GUI. The vulnerability was internally discovered and reported by members of the Fortinet Product Security team.