Improper neutralization of special elements used in a command
CVSSv3 Score: 7.6 An Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') [CWE-88] in FortiMail may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface. Revised on 2026-11-10 00:00:00
Read at Fortinet PSIRT Advisories
- Vendor
- Fortinet
- Product
- FortiMail, FortiNAC / FortiAuthenticator
- CVSS v3.0
- 7.6
- Exposure class
- Email, Identity
Why it ranks 51 (High)
- CVSS v3.0 7.6 high
- Exposed product class: email, identity
- Widely deployed vendor product (Fortinet)
- Vendor security advisory
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- Fortinet PSIRT Advisories (fortiguard.fortinet.com)
Related coverage
Other items that share a CVE or were clustered with this one.