Threats tagged 'ghsa-6mf9-jg68-3wmj'

CVE-2026-126166 is a vulnerability in Fortinet FortiMail versions 7.2 (all versions), 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.2. It involves improper neutralization of argument delimiters in commands, allowing an authenticated remote attacker with domain admin or admin privileges to perform unauthorized actions on a paired FortiAuthenticator device. These actions include deleting users from other tenant domains, executing arbitrary code as root, running arbitrary CLI commands, and reading or writing arbitrary files via crafted HTTP requests to the administrative interface.