Improper neutralization of special elements used in an os command
FG-IR-26-200
Summary
CVSSv3 Score:
9.1
An Incorrect Authorization vulnerability [CWE-863] in FortiMail may allow an unauthenticated remote attacker to obtain an authenticated IBE webmail session as any IBE recipient and read or send their encrypted mail via crafted HTTP requests.
Revised on 2026-11-10 00:00:00
Products covered
FortiMail
Remediation
Separate remediation guidance was not included in the collected bulletin.
CVEs in this advisory 1
Updates
- Published by Fortinet
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.