{"id":"EM-20261112-N569","url":"https://cyber.eventmonitor.net/incident/EM-20261112-N569/critical-fortinet-fortimail-vulnerability-cve-2026-126148/","type":"cve","title":"Critical Fortinet FortiMail Vulnerability (CVE-2026-126148)","subtitle":"CVE-2026-126148","subject":"CVE-2026-126148","status":"Developing","severity":"critical","affected":[],"headline":null,"born":"2026-11-12T03:41:26.000Z","firstSignal":"2026-11-11T22:17:12.010Z","lastSignal":"2026-11-12T03:41:26.000Z","updated":"2026-11-12T15:50:47.989Z","revision":1,"life":[{"status":"Born","at":"2026-11-12T03:41:26.000Z","why":"second independent source: C31 Vulners (new public exploits)"},{"status":"Developing","at":"2026-11-12T03:41:26.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-11T22:17:12.010Z","what":"First signal: C6 NVD CVE API 2.0"},{"at":"2026-11-12T03:41:26.000Z","what":"Born: second source, C31 Vulners (new public exploits). Page EM-20261112-N569 created."}],"stages":[{"name":"Disclosed","at":"2026-11-11T22:17:12.010Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-11T22:17:12.010Z","detail":"CVSS 9.8 · EPSS 2.4%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-11T22:17:12.010Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":4,"title":"CVE-2026-126148 (CVSS 9.8)","text":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted HA join-request packets.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126148"},{"at":"2026-11-12T03:41:26.000Z","source":"C31","sourceName":"Vulners (new public exploits)","role":"Research & News","severity":3,"title":"Public exploit: Exploit for CVE-2026-126148","text":"# CVE-2026-126148 — FortiMail HA join-request OS command injection (CWE-78)\n\n| | |\n|---|---|\n| **CVE** | CVE-2026-126148 |\n| **Component** | Fortinet FortiMail — high-availability cluster, join-request handling (`lab/fortimail_ha.py`, modelled) |\n| **Affected** | FortiMail `8.0.0`–`8.0.1`…","url":"https://github.com/googlesky/CVE-2026-126148"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-11T22:17:12.010","score":9.8,"severity":"CRITICAL","desc":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted HA join-request packets.","product":"","seen":1794443466720},"kev":null,"epss":{"epss":0.02445,"pct":0.84564,"at":1794498647989},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}