CVE-2026-126147

Name of the Vulnerable Software and Affected Versions FortiMail versions 8.0.0 through 8.0.1 FortiMail versions 7.6.0 through 7.6.6 FortiMail versions 7.4.0 through 7.4.8 FortiMail version 7.2 (all versions)

Description An improper limitation of a pathname to a restricted directory, known as path traversal, allows an unauthenticated attacker to execute unauthorized code or commands via crafted requests. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables that store file paths.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.