External risk intelligence

FortiMail Path Traversal Vulnerability Allows Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-126147

FortiMail is an email security gateway product designed to be deployed at the network edge to inspect incoming and outgoing email traffic. As a public-facing security appliance that must listen for and process internet-originated connections to fulfill its primary function, it is inherently exposed to the public internet by design.

Path Traversal

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability involves a path traversal flaw in Fortinet's FortiMail product, which is an email security gateway. The flaw, if exploited, could allow an unauthorized attacker to run code or commands on the system through specially crafted requests, potentially impacting the confidentiality, integrity, and availability of the system.

Attackers can run commands via email.
Affects email security gateway; high criticality.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted requests to an exposed FortiMail device. This could allow them to navigate the file system and potentially execute code or commands, leading to unauthorized system access.

Network exposure required.
Crafted requests trigger vulnerability.
Unauthorized code execution possible.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker could execute unauthorized code or commands on FortiMail systems when supported by crafted requests. This could impact the integrity and availability of the system.

System commands and code execution.
Via crafted network requests.
Compromise of system integrity and availability.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts FortiMail email security gateways, which are typically deployed at the network edge and process internet-originated traffic. Infrastructure and security teams are likely responsible for managing these devices. The first practical step is to identify all FortiMail instances, determine their internet reachability and business criticality, and then coordinate with the accountable owner to plan remediation during a maintenance window.

Infrastructure and security teams own this.
Verify internet-facing FortiMail reachability.
Plan remediation based on asset criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is FortiMail?

FortiMail is an email security gateway engineered to protect organizations by filtering incoming and outgoing email traffic. Because it acts as a gatekeeper, it is typically positioned at the network edge to inspect communications before they reach internal systems. This positioning allows it to defend against spam, phishing, and malware, but also makes its availability and integrity critical to overall network security.

What does path traversal mean in CVE-2026-126147?

This vulnerability is classified as CWE-22, or improper limitation of a pathname to a restricted directory. In plain English, the software fails to properly validate file paths provided in incoming requests. This allows an attacker to 'traverse' outside of the intended, secure folders and access or manipulate files elsewhere on the system, which can ultimately lead to unauthorized code execution.

How does an attacker trigger this vulnerability?

An attacker triggers the flaw by sending a specially crafted network request to the FortiMail device. Because the system does not properly restrict these paths, the request acts as a key to reach unauthorized areas. Note that standard, legitimate email traffic that follows normal protocol rules does not trigger this vulnerability; the attack specifically requires the submission of these malicious, non-standard request structures.

Is my FortiMail device at risk?

If you are running the affected versions, your risk is significant. Halo Surface Signal identifies FortiMail as a public-facing security appliance, meaning it is designed to listen for and process traffic directly from the internet. Because it must remain reachable from the outside to perform its security functions, it is inherently exposed to external network requests that could target this vulnerability.

What should I do first to address CVE-2026-126147?

Your first step is to perform an inventory of all FortiMail instances in your environment to identify which systems are running the affected software versions. Once identified, evaluate their network reachability and business criticality. Work with your infrastructure and security teams to prioritize these assets for remediation, ensuring you have a planned maintenance window to apply updates or protective measures.

References

fortiguard.fortinet.com/psirt/FG-IR-26-199

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.