FortiMail command injection allows unauthenticated code execution

# FortiMail command injection allows unauthenticated code execution

https://gcdradar.vercel.app/incidents/fortimail-command-injection-allows-unauthenticated-code-exec · AIR-2026-1871 · live

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability): Critical CVSS 9.8 disclosed vulnerability, no confirmed exploitation
- Fix status: Fix status unknown
- First reported: 2026-11-10
- AI role: No AI role
- Products: FortiMail
- CVSS: 9.8

## Summary

An improper neutralization of special elements in a command (CWE‑77) in FortiMail permits an unauthenticated attacker to execute unauthorized code via crafted HA join‑request packets. The vulnerability carries a CVSS v3 score of 9.8, indicating a critical risk.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-11-10: Improper neutralization of special elements used in an SQL command (https://fortiguard.fortinet.com/psirt/FG-IR-26-216)
- 2026-11-10: Improper neutralization of special elements used in an os command (https://fortiguard.fortinet.com/psirt/FG-IR-26-200)

## Sources

- 2026-11-10 Fortinet: Improper neutralization of special elements used in an os command https://fortiguard.fortinet.com/psirt/FG-IR-26-200
- 2026-11-10 Fortinet: Improper neutralization of special elements used in an SQL command https://fortiguard.fortinet.com/psirt/FG-IR-26-216

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.