FortiMail path traversal, unauth RCE (CVE-2026-126147) [PoC]

Exploitation confirmed - public proof-of-concept - CVE-2026-126147 is a critical path traversal in FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all 7.2 versions that lets an unauthenticated attacker execute unauthorized code or commands on the appliance. Patched in 8.0.2 - update immediately.

Overview

FortiMail’s path traversal weakness stems from improper limitation of a pathname to a restricted directory. In plain terms, the appliance accepts crafted requests that use directory traversal sequences to reach files and functionality outside the intended restricted area. Because the boundary between safe and unsafe filesystem paths is not enforced, an attacker can reach parts of the system they should never touch.

Fortinet rates this flaw CRITICAL at CVSS 9.8, with a vector of network attack, low complexity, no privileges required, and no user interaction. That combination means a remote attacker can trigger it with simple, repeatable requests against a reachable interface. No credential, victim click, or special condition is needed.

Impact

Successful exploitation lets an unauthenticated attacker execute unauthorized code or commands on the FortiMail appliance. Since FortiMail is the mail security gateway, that level of access is serious. An attacker with command execution could intercept or alter mail flow, read sensitive message content, pivot deeper into the network, or use the appliance as a foothold for further attacks. This is the kind of pre-authentication access that turns a perimeter device into an entry point.

Organizations running affected versions should treat this as high exposure, especially where the administrative or mail interfaces are reachable from the internet.

Remediation and Mitigation

• Upgrade immediately. Move to FortiMail 8.0.2 or later, which fixes the path traversal. If you run 7.6.x, 7.4.x, or 7.2.x, apply the corresponding fixed release per Fortinet’s advisory.
• Restrict exposure. Limit access to management interfaces and trusted networks. Do not expose administrative or mail interfaces broadly until you have patched.
• Monitor for abuse. Review logs for unusual traversal patterns (encoded ../ sequences) and unexpected command execution or file access on the appliance.
• Check for compromise. Inspect for rogue accounts, altered configurations, and outbound connections you did not authorize.

Security Insight

FortiMail devices have attracted real threat-actor interest before. A recent FortiMail zero-day was exploited in live campaigns, and the same ecosystem has seen repeated targeting of Fortinet perimeter products, as with this FortiClient EMS flaw used to deploy a credential stealer. A pre-authentication flaw in a mail gateway is an attractive target for the same actors, so do not wait for exploitation reports before patching. For broader context on active campaigns this month, see our weekly threat roundup.

Further Reading

• FortiMail zero-day CVE-2026-104286 exploited
• Weekly Threat Roundup: Nx Console Supply Chain Attack (May 25-31)
• Threat Actors Exploit Critical FortiClient EMS Flaw to
• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs