CVE-2026-126183 is an authorization bypass vulnerability in Fortinet FortiManager versions 7.2.0 through 8.0.1 and corresponding FortiManager Cloud versions. It allows an authenticated attacker to execute commands beyond their expected permissions by sending specially crafted HTTP requests. The vulnerability affects multiple FortiManager and FortiManager Cloud releases across several major versions.
A format string vulnerability exists in Fortinet FortiAnalyzer and FortiManager products, including their cloud versions, across multiple 7.x and 8.x releases. This vulnerability allows an authenticated attacker to execute unauthorized commands via specially crafted HTTP requests. The flaw affects versions 7.2.0 through 7.2.12, 7.4.0 through 7.4.11, 7.6.0 through 7.6.7, and 8.0.0 through 8.0.1 for both FortiAnalyzer and FortiManager, including their cloud variants.
CVE-2026-126168 is a vulnerability in Fortinet FortiMail versions 7.2 all versions, 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.2. It involves improper neutralization of argument delimiters in commands, allowing an authenticated attacker with domain admin or admin privileges to perform unauthorized actions such as deleting users on a paired FortiAuthenticator, executing arbitrary code as root, and reading or writing arbitrary files via crafted HTTP requests to the administrative interface.
An SQL injection vulnerability exists in multiple versions of Fortinet FortiAnalyzer and FortiManager products, including their cloud variants. This vulnerability allows an authenticated attacker to execute unauthorized code or commands by sending crafted JSON-RPC requests. The affected versions span several release lines, potentially impacting confidentiality, integrity, and availability of the affected systems.
CVE-2026-126166 is a vulnerability in Fortinet FortiMail versions 7.2 (all versions), 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.2. It involves improper neutralization of argument delimiters in commands, allowing an authenticated remote attacker with domain admin or admin privileges to perform unauthorized actions on a paired FortiAuthenticator device. These actions include deleting users from other tenant domains, executing arbitrary code as root, running arbitrary CLI commands, and reading or writing arbitrary files via crafted HTTP requests to the administrative interface.
An XML injection vulnerability (blind XPath injection) exists in multiple versions of Fortinet FortiAnalyzer and FortiManager products, including their cloud variants. This flaw allows an unauthenticated remote attacker to inject arbitrary content into a signed SAML response by sending crafted SAML requests. The vulnerability affects versions 7.2.0 through 7.6.7 and 8.0.0 of these products. It has a high severity score of 8.1 CVSS 3.1, indicating significant impact on confidentiality, integrity, and availability.
A heap-based buffer overflow vulnerability exists in multiple versions of Fortinet FortiAnalyzer and FortiManager products, including their cloud variants. This flaw allows an authenticated attacker with administrative privileges to execute unauthorized code or commands by sending a specially crafted request. The vulnerability affects versions 7.2.0 through 8.0.1 across several product lines. It has a high severity rating with a CVSS score of 7.2.
An improper authentication vulnerability exists in Fortinet FortiMail versions 7.2 all versions, 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1. This flaw may allow an unauthenticated attacker to escalate privileges and release or delete quarantined messages for arbitrary mailboxes by sending crafted quarantine release requests.
An authentication bypass vulnerability exists in multiple versions of Fortinet FortiAnalyzer and FortiManager products, including their cloud variants. This flaw allows an attacker to spoof authentication and potentially disrupt the High Availability (HA) state of affected devices. The vulnerability affects versions from 7.2.0 through 8.0.1 across various FortiAnalyzer and FortiManager releases. The CVSS score is 8.2, indicating high severity due to the potential for denial of service impact. No public exploits or patches are currently documented in the provided data.
A vulnerability in Fortinet FortiMail versions 7.2 all versions, 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1 allows a remote unauthenticated attacker to cause a denial of service by triggering a memory allocation with an excessive size value via a specially crafted SMTP attachment.
An improper certificate validation vulnerability exists in Fortinet FortiOS versions 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, and 7.2.0 through 7.2.13. This flaw may allow a remote, unauthenticated attacker to perform a Man-in-the-Middle (MitM) attack on the SSLVPN web portal's communication with backend destination websites.
An authentication algorithm vulnerability exists in Fortinet FortiMail versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all versions of 7.2. This flaw may allow an unauthenticated remote attacker to elevate privileges and take over accounts via a crafted request.
An OS command injection vulnerability exists in multiple Fortinet products including FortiMail, FortiRecorder, and FortiVoice across various versions. This flaw allows an authenticated attacker to execute unauthorized commands via specially crafted HTTP requests. The vulnerability affects versions of FortiMail from 7.2 all versions through 8.0.1, FortiRecorder versions 7.0.0 through 7.6.2, and FortiVoice versions 7.0.0 through 8.0.1. The CVSS v3.1 score is 8.8, indicating high severity with impacts on confidentiality, integrity, and availability. No patch or remediation information is provided in the available data.
An OS command injection vulnerability exists in Fortinet FortiMail versions 7.2 (all versions), 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1. This flaw allows an authenticated administrator with system-time read-write access to execute unauthorized commands as root due to improper neutralization of special elements in OS commands.
CVE-2026-126156 is a critical authorization bypass vulnerability affecting Fortinet FortiMail versions 7.2 (all versions), 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1. This flaw allows an unauthenticated remote attacker to take over an arbitrary IBE recipient account by sending crafted HTTP requests. The vulnerability has a high CVSS score of 9.1, indicating severe confidentiality and integrity impact without requiring user interaction or privileges.
A path traversal vulnerability exists in Fortinet FortiMail versions 7.2 (all versions), 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1. This flaw allows an unauthenticated attacker to execute unauthorized code or commands by sending specially crafted requests. The vulnerability is critical with a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.
A vulnerability in Fortinet FortiMail versions 8.0.0, 7.6.0 through 7.6.5, 7.4.0 through 7.4.7, and 7.2.0 through 7.2.9 allows an unauthenticated attacker to reset the password of any IBE webmail user. This is due to a weak password recovery mechanism that can be exploited via specially crafted HTTP requests, potentially leading to account takeover.
CVE-2026-126146 is an OS command injection vulnerability affecting multiple versions of Fortinet FortiMail and FortiRecorder. It allows an authenticated privileged attacker to execute unauthorized commands via a specially crafted archive account configuration. The vulnerability impacts FortiMail versions 7.2.0 through 7.2.9, 7.4.0 through 7.4.6, 7.6.0 through 7.6.4, and 8.0.0 through 8.0.1, as well as FortiRecorder versions 7.0.0 through 7.0.6, 7.2.0 through 7.2.11, and 7.6.0. The CVSS v3.1 score is 7.2, indicating a high severity. No patch or remediation information is provided in the data.
A path traversal vulnerability exists in Fortinet FortiMail versions 7.2 (all versions), 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1. This flaw allows an unauthenticated attacker to execute unauthorized commands by sending specially crafted requests that bypass directory restrictions.
An integer overflow or wraparound vulnerability exists in Fortinet FortiMail versions 7.2 (all versions), 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1. This flaw may allow a remote unauthenticated attacker to cause a denial of service by crashing the FortiMail daemon.