PULSEUnderground Intel

EN VIVO21señales / 24h

FEED

ransomplay reclama a Minor League Baseball · US · Hospitalityransomn0n reclama a Company #213 · QAransomn0n reclama a Company #212 · ETransomdoommageddon reclama a K**** T**** H**** B****ransomcurious worm reclama a sacheminc.com · CA · Manufacturingransomcurious worm reclama a sbhny.org · USransomcurious worm reclama a shannonhealth.com · IE · Healthcareransomcurious worm reclama a baronandbudd.com · GB · Professional Servicesransomeverstake reclama a ki*****o.comransomcurious worm reclama a raleighortho.com · US · Healthcareransomcurious worm reclama a lifelinescreening.com · US · Healthcareransomcurious worm reclama a safcodental.com · SA · Healthcareransomcurious worm reclama a marquiscompanies.com · US · Professional Servicesransomcurious worm reclama a atlashp.com · Technologyransomplay reclama a Minor League Baseball · US · Hospitalityransomn0n reclama a Company #213 · QAransomn0n reclama a Company #212 · ETransomdoommageddon reclama a K**** T**** H**** B****ransomcurious worm reclama a sacheminc.com · CA · Manufacturingransomcurious worm reclama a sbhny.org · USransomcurious worm reclama a shannonhealth.com · IE · Healthcareransomcurious worm reclama a baronandbudd.com · GB · Professional Servicesransomeverstake reclama a ki*****o.comransomcurious worm reclama a raleighortho.com · US · Healthcareransomcurious worm reclama a lifelinescreening.com · US · Healthcareransomcurious worm reclama a safcodental.com · SA · Healthcareransomcurious worm reclama a marquiscompanies.com · US · Professional Servicesransomcurious worm reclama a atlashp.com · Technology

← Todos los CVEs

CVE Watch11 nov 2026

CVE-2026-126167

A improper neutralization of special elements used in a command ('command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.

CVSS

7.2

Alto

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 11 nov 2026 · Última mod.: 11 nov 2026 · CWE-77

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

A improper neutralization of special elements used in a command ('command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface.

Referencias oficiales

fortiguard.fortinet.comhttps://fortiguard.fortinet.com/psirt/FG-IR-26-218

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-960537.8 ALT

——16Improper neutralization of special elements used in a command ('command injection') in Windows Task Scheduler allows an authorized attacker to elevate privileges locally.1d CVE-2026-839535.5 MED

——17Improper neutralization of special elements used in a command ('command injection') in Github Copilot allows an authorized attacker to disclose information locally.1d CVE-2026-1233878.0 ALT

——17Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an authorized attacker to elevate privileges over a network.1d CVE-2026-1216628.6 ALT

——14Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code locally.1d CVE-2026-1199898.2 ALT

——15Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an authorized attacker to execute code over a network.1d CVE-2026-1169308.8 ALT

——18Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an unauthorized attacker to execute code over a network.1d