FortiMail HA join-request OS command injection lets unauthenticated attackers execute code (CVE-2026-126148)

What happened

An unauthenticated attacker who can reach FortiMail's high-availability (HA) join-request service can send crafted HA join-request packets to trigger an OS command injection flaw. Successful exploitation allows unauthorized code or command execution on the device.

Fortinet describes the issue as improper neutralization of special elements used in an OS command. The CVSS v3.1 score is 9.8, with a network attack vector, low complexity, no privileges, and no user interaction, leading to high confidentiality, integrity, and availability impact.

Neither the CVE record nor Fortinet's advisory lists exploitation in the wild or public disclosure.

Who is affected

Affected products are FortiMail 8.0.0 through 8.0.1 and FortiMail 7.6.0 through 7.6.6. Organisations running these versions should treat the HA join-request service as an unauthenticated network-exposed surface and review any access path to it.

What to do now

1. Fortinet has not published fixed versions or a workaround in FG-IR-26-200. Check the advisory for updates before applying standard patch management.
2. Restrict access to FortiMail HA and management interfaces to trusted HA peer addresses; disable the HA service if it is not in use.
3. Place FortiMail behind network segmentation so that HA join-request traffic cannot originate from untrusted networks.
4. Monitor Fortinet advisory FG-IR-26-200 for a fixed release.

How to detect it

Fortinet has not published indicators of compromise for this flaw. The exposed surface is the FortiMail HA join-request service; check whether that service is reachable from untrusted networks.

Beyond the patch

Because this is reachable over the network without credentials, exposure management matters as much as the eventual patch. Virtual CISO Services can help identify which FortiMail HA and management ports are reachable from untrusted networks. Since this is an injection flaw, Implementation & Assessment Services can validate hardening and configuration around the HA service.