FortiMail unauthenticated RCE via HA packets (CVE-2026-126148) [PoC]

Exploitation confirmed - public proof-of-concept - CVE-2026-126148 is a critical OS command injection in Fortinet FortiMail 8.0.0 through 8.0.1 and 7.6.0 through 7.6.6 that grants unauthenticated attackers remote code execution through crafted HA join-request packets. No vendor patch is listed for these branches; restrict HA ports and upgrade as soon as fixed builds are available.

Overview

FortiMail is Fortinet’s email security gateway, often deployed directly on the internet edge to filter inbound mail. High Availability (HA) mode lets two or more FortiMail nodes form a cluster, synchronizing configuration and state. The join-request packet is the message a candidate node sends to an existing cluster during that handshake.

CVE-2026-126148 is a command injection bug in how FortiMail handles those join-request packets. The device takes special shell metacharacters from packet content and passes them into an operating system command without neutralizing them. Because the HA join handler runs before any authentication check, an attacker who can reach the HA service does not need credentials, a valid session, or any user interaction.

The CVSS score is 9.8, with a network attack vector, low complexity, and no privileges or user interaction required. That combination means the only real precondition is network reachability to the HA listener.

Impact

An unauthenticated attacker who can send crafted join-request packets to an affected FortiMail node can execute arbitrary commands or code under the privileges of the HA service. In practice that puts an email gateway, a system that holds mail flow, TLS keys, directory credentials, and routing configuration, in attacker hands. Possible outcomes include full device compromise, interception or exfiltration of mail, lateral movement into the internal network using credentials stored on the appliance, and disruption of mail delivery for the whole organization.

Systems running in standalone mode do not expose the HA join handler in the same way, but clustered deployments and any node with HA ports reachable from untrusted networks carry the highest risk.

Remediation and Mitigation

• Upgrade to FortiOS/FortiMail 7.6.7 or 8.0.2 (or later) once Fortinet publishes fixed builds for these branches. Track the Fortinet PSIRT advisory for the confirmed fixed release list.
• Block HA ports (TCP 22, 443, and 51999 by default, depending on configuration) from the internet and from any untrusted segment. HA traffic should only flow between known cluster peers over a dedicated, isolated link.
• Segment HA networks so only peer appliance IPs can reach the join handler. Use host-level firewall rules on the appliance itself where supported.
• Rotate credentials and TLS material stored on any node that may have been reachable by untrusted parties while unpatched.
• Monitor appliance logs for unexpected HA join attempts, malformed packets, and unusual outbound connections from the FortiMail host.

Related reading: FortiMail zero-day CVE-2026-104286 exploited, Threat Actors Exploit Critical FortiClient EMS Flaw to, and the Weekly Threat Roundup: Nx Console Supply Chain Attack (May 25-31).

Security Insight

FortiMail is now on its second critical, pre-authentication HA flaw in a single release cycle, following CVE-2026-104286. The recurrence points to the HA handshake as a structurally weak code path: it must accept packets from peers before trust is established, and it keeps feeding that pre-trust data into shell-invoking code. Fortinet’s 9.8-severity stream across FortiMail, FortiClient EMS, and FortiOS also suggests a pattern of adversarial attention aimed squarely at the vendor’s management and telemetry planes. Assume HA services on any Fortinet edge appliance are hostile-facing interfaces, not internal plumbing.

Further Reading

• FortiMail zero-day CVE-2026-104286 exploited
• Weekly Threat Roundup: Nx Console Supply Chain Attack (May 25-31)
• Threat Actors Exploit Critical FortiClient EMS Flaw to
• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs