CVE-2026-126151: High severity vulnerability
A incorrect implementation of authentication algorithm vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to gain elevation of privilege (account takeover) via a crafted request.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FortiMailto a version that resolves this vulnerability.Fixed in 7.4.9 - Upgrade
Upgrade
FortiMailto a version that resolves this vulnerability.Fixed in 7.6.7 - Upgrade
Upgrade
FortiMailto a version that resolves this vulnerability.Fixed in 8.0.2
Event History
Frequently Asked Questions
Which FortiMail deployments are affected?
Affected versions are FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all FortiMail 7.2 versions.
Does exploitation require authentication or user interaction?
No. The vulnerability can be exploited remotely by an unauthenticated attacker using a crafted request, and it does not require user interaction.
What could an attacker achieve?
A successful exploit may allow elevation of privilege resulting in account takeover. The provided information does not indicate an impact on availability or integrity.