Threats tagged 'ghsa-mjmp-97qr-g3pc'

CVE-2026-126167 is a command injection vulnerability in Fortinet FortiMail versions 7.2 all versions, 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.2. It allows an authenticated remote attacker with domain admin or admin privileges to execute arbitrary commands as root, delete users of other tenant domains on a paired FortiAuthenticator, and read or write arbitrary files via crafted HTTP requests to the administrative interface.