Is CVE-2026-126166 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126166 being exploited in the wild.

How severe is CVE-2026-126166?

High severity, with a CVSS score of 7.2, published 11 November 2026.

Which products and versions are affected?

Fortinet FortiMail 7.2 all versions, 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, 8.0.0 through 8.0.2.

Is there a fix for CVE-2026-126166?

Yes: fixed in FortiMail 7.4.9 or above, 7.6.7 or above, 8.0.3 or above; FortiMail 7.2 requires migration to a fixed release. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-126166 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-126166?

Check whether you run Fortinet FortiMail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126166: Fortinet FortiMail argument injection in admin interface

CVE-2026-126166 · Severity: high · CVSS 7.2 · Published 2026-11-11

FortiMail is an email security appliance that protects organizations from email-based threats. An authenticated attacker with domain admin or admin privileges can inject malicious arguments through the web administration interface to execute arbitrary code and commands as root, delete users on paired authentication servers, and read or write files on the system. This gives an insider with admin access a way to escalate privileges and compromise the entire mail infrastructure.

Technologies: Fortinet FortiMail. Vendors: Fortinet.

Quick answers

Is CVE-2026-126166 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126166 being exploited in the wild.
How severe is CVE-2026-126166?: High severity, with a CVSS score of 7.2, published 11 November 2026.
Which products and versions are affected?: Fortinet FortiMail 7.2 all versions, 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, 8.0.0 through 8.0.2.
Is there a fix for CVE-2026-126166?: Yes: fixed in FortiMail 7.4.9 or above, 7.6.7 or above, 8.0.3 or above; FortiMail 7.2 requires migration to a fixed release. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126166 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-126166?: Check whether you run Fortinet FortiMail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: FortiMail 7.4.9 or above, 7.6.7 or above, 8.0.3 or above; FortiMail 7.2 requires migration to a fixed release

Technical details

An argument injection vulnerability (CWE-88) exists in the FortiMail administrative GUI that fails to properly neutralize special characters in command arguments. An authenticated attacker holding domain admin or admin privileges can craft malicious HTTP requests to execute arbitrary CLI commands and code as root, delete users from paired FortiAuthenticator instances, and perform unauthorized file operations. The vulnerability requires existing administrative credentials and affects versions 7.2 through 8.0.2.

Affected products

Fortinet FortiMail 7.2 all versions, 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, 8.0.0 through 8.0.2

Timeline

2026-11-10: disclosed
2026-10-05: patched: FortiMail Cloud updated to v7.6.7 GA or v8.0.2 GA

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-218

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.