FortiMail path traversal allows unauthenticated code execution (CVE-2026-126147)

What happened

CVE-2026-126147 is a path traversal vulnerability (CWE-22) in FortiMail. An unauthenticated attacker can send crafted requests that escape directory restrictions and execute unauthorized code or commands. The CVSS 3.1 rating is 9.8 critical because the flaw is reachable over the network with low attack complexity, requires no privileges and no user interaction, and has high impact on confidentiality, integrity and availability.

The CVE record does not list exploitation and Fortinet has not said the flaw is being exploited or that details have been publicly disclosed. Fortinet's PSIRT advisory FG-IR-26-199 lists no fixed version and no workaround at the time of publication.

Who is affected

The affected product is FortiMail. The affected versions are:

• FortiMail 8.0.0 through 8.0.1
• FortiMail 7.6.0 through 7.6.6
• FortiMail 7.4.0 through 7.4.8
• FortiMail 7.2.0 through 7.2.9

If you run any of these versions, treat the system as potentially reachable by an unauthenticated attacker until you can confirm network access is restricted.

What to do now

1. Confirm whether your FortiMail management or user interfaces are reachable from the internet. Remove public exposure where it is not strictly required.
2. Restrict access to FortiMail to trusted internal networks, a VPN or a jump host.
3. If the system must remain network-reachable, apply compensating network controls and monitor access and administrative logs closely.
4. Watch Fortinet's PSIRT advisory FG-IR-26-199 for a fixed version or workaround — none is listed yet.

Beyond the patch

Because this flaw is reachable over the network without credentials, the immediate question is whether FortiMail is exposed anywhere in your estate. Virtual CISO Services can help with exposure management across internet-facing services, and Supply Chain Defense & Third-Party Risk can help track vendor patch cycles for products you rely on. A penetration test is the most direct way to find similar unauthenticated path traversal or injection issues before they are disclosed.