Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-126150 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-12 |
| Vendor | Fortinet |
| Product | FortiMail |
| Vulnerability Type | weak password recovery mechanism (CWE-640) |
| CVSS Score | 9.1 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
A weak password recovery mechanism for forgotten password vulnerability in Fortinet FortiMail 8.0.0, 7.6.0 through 7.6.5, 7.4.0 through 7.4.7 and 7.2.0 through 7.2.9 may allow an unauthenticated attacker to reset the password of an arbitrary IBE webmail user and take over their account via specially crafted HTTP requests.
IBE (Identity-Based Encryption) is the FortiMail mail encryption feature in which external recipients read encrypted messages via a webmail portal. The portal has to be reachable from the internet, which increases exposure. Account takeover gives access to the recipient’s encrypted mail.
Required Actions
- Update FortiMail to the version listed in Fortinet advisory FG-IR-26-202.
- If you do not use IBE encryption, disable it; if you do — until patched, monitor IBE portal logs for password resets and logins from unusual addresses.
Who Is Affected?
The vulnerability affects Fortinet FortiMail 8.0.0, 7.6.0–7.6.5, 7.4.0–7.4.7 and 7.2.0–7.2.9 with IBE encryption enabled. FortiMail is an email security gateway, typically exposed to the internet (SMTP, webmail) and used by enterprises and public institutions.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-126150 vulnerability?
CVE-2026-126150 is a weak password recovery mechanism flaw (CWE-640) in Fortinet FortiMail that allows resetting the password of any IBE webmail user and taking over their account. CVSS score: 9.1.
Does exploiting CVE-2026-126150 require authentication?
No. The attack requires no authentication or user interaction.
How to protect against CVE-2026-126150?
Update FortiMail as per advisory FG-IR-26-202 and restrict access to the device interfaces.
Who is affected by CVE-2026-126150?
Organizations running FortiMail 7.2.0–7.2.9, 7.4.0–7.4.7, 7.6.0–7.6.5 or 8.0.0 with IBE encryption.
