CVE-2026-126157: Critical severity vulnerability
A improper authentication vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to gain access to other users' secure email accounts via crafted HTTP requests.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FortiMailto a version that resolves this vulnerability.Fixed in 7.4.9 - Upgrade
Upgrade
FortiMailto a version that resolves this vulnerability.Fixed in 7.6.7 - Upgrade
Upgrade
FortiMailto a version that resolves this vulnerability.Fixed in 8.0.2
Event History
Frequently Asked Questions
Which FortiMail deployments are affected?
Affected versions are FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all FortiMail 7.2 versions.
What does an attacker need to exploit this issue?
An attacker does not need authentication or user interaction. Exploitation is performed using crafted HTTP requests.
What access could an attacker obtain?
A successful attacker may gain access to other users' secure email accounts. The provided data does not indicate whether access is limited to particular account types or functions.