Paper/Archive/CVE-2026-126157

CVE-2026-126157

Fortinet FortiMail — A improper authentication vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through…

CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (CNA)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 No EPSS score.000 × 200.0 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

A improper authentication vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to gain access to other users' secure email accounts via crafted HTTP requests.

Affected

ProductAffectedFixed inSource

FortiMail8.0.0 – 8.0.1–CNA

FortiMail7.6.0 – 7.6.6–CNA

FortiMail7.4.0 – 7.4.8–CNA

FortiMail7.2.0 – 7.2.9–CNA

FortiMail7.0.0 – 7.0.9–CNA

Scores by source

fortinet (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C

References

reffortiguard.fortinet.com/psirt/FG-IR-26-209