CVE-2026-126156: Critical severity vulnerability

Published Nov 11, 2026

Updated

A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to take over an arbitrary IBE recipient account via crafted HTTP requests.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FortiMail to a version that resolves this vulnerability.
Fixed in 7.4.9
Upgrade
Upgrade FortiMail to a version that resolves this vulnerability.
Fixed in 7.6.7
Upgrade
Upgrade FortiMail to a version that resolves this vulnerability.
Fixed in 8.0.2

Event History

Nov 11, 2026

CVE Published

via MITRE·09:29 PM

Data Sourced

via MITRE·09:29 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Affected versions are FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all FortiMail 7.2 versions.

Does exploitation require an authenticated account or user interaction?

No. The issue can be exploited remotely by an unauthenticated attacker using crafted HTTP requests, and it does not require user interaction.

What access could an attacker obtain?

An attacker may be able to take over an arbitrary IBE recipient account.

CVE-2026-126156: Critical severity vulnerability

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

Does exploitation require an authenticated account or user interaction?

What access could an attacker obtain?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

Does exploitation require an authenticated account or user interaction?

What access could an attacker obtain?