Paper/Archive/CVE-2026-126150

CVE-2026-126150

Fortinet FortiMail — A weak password recovery mechanism for forgotten password vulnerability in Fortinet FortiMail 8.0.0, FortiMail 7.6.0 through 7.6.5, Forti…

CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (CNA)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 No EPSS score.000 × 200.0 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

A weak password recovery mechanism for forgotten password vulnerability in Fortinet FortiMail 8.0.0, FortiMail 7.6.0 through 7.6.5, FortiMail 7.4.0 through 7.4.7, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to reset the password of an arbitrary IBE webmail user and take over their account via specially crafted HTTP requests.

Affected

ProductAffectedFixed inSource

FortiMail8.0.0–CNA

FortiMail7.6.0 – 7.6.5–CNA

FortiMail7.4.0 – 7.4.7–CNA

FortiMail7.2.0 – 7.2.9–CNA

Scores by source

fortinet (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:R

References

reffortiguard.fortinet.com/psirt/FG-IR-26-202