Paper/Archive/CVE-2026-126156

CVE-2026-126156

Fortinet FortiMail — A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6…

CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (CNA)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 No EPSS score.000 × 200.0 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to take over an arbitrary IBE recipient account via crafted HTTP requests.

Affected

ProductAffectedFixed inSource

FortiMail8.0.0 – 8.0.1–CNA

FortiMail7.6.0 – 7.6.6–CNA

FortiMail7.4.0 – 7.4.8–CNA

FortiMail7.2.0 – 7.2.9–CNA

Scores by source

fortinet (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C

References

reffortiguard.fortinet.com/psirt/FG-IR-26-208