CVE-2026-126155: Critical severity vulnerability
Published Nov 11, 2026
·Updated
A incorrect authorization vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to obtain an authenticated IBE webmail session as any IBE recipient and read or send their encrypted mail via crafted HTTP requests.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FortiMailto a version that resolves this vulnerability.Fixed in 7.4.9 - Upgrade
Upgrade
FortiMailto a version that resolves this vulnerability.Fixed in 7.6.7 - Upgrade
Upgrade
FortiMailto a version that resolves this vulnerability.Fixed in 8.0.2
Event History
Nov 11, 2026
CVE Published
via MITRE·09:29 PM
Data Sourced
via MITRE·09:29 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·10:17 PM
DescriptionSeverityWeakness