Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-126155 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-12 |
| Vendor | Fortinet |
| Product | FortiMail |
| Vulnerability Type | incorrect authorization (CWE-863) |
| CVSS Score | 9.1 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
An incorrect authorization vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8 and 7.2 all versions may allow an unauthenticated remote attacker to obtain an authenticated IBE webmail session as any IBE recipient and read or send their encrypted mail via crafted HTTP requests.
IBE (Identity-Based Encryption) is the FortiMail mail encryption feature in which external recipients read encrypted messages via a webmail portal. The portal has to be reachable from the internet, which increases exposure. The flaw breaks the confidentiality of encrypted mail and allows sending messages on behalf of the recipient.
Required Actions
- Update FortiMail to the version listed in Fortinet advisory FG-IR-26-207.
- If you do not use IBE encryption, disable it; if you do — until patched, monitor IBE portal logs for password resets and logins from unusual addresses.
Who Is Affected?
The vulnerability affects Fortinet FortiMail 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8 and all 7.2 versions with IBE encryption enabled. FortiMail is an email security gateway, typically exposed to the internet (SMTP, webmail) and used by enterprises and public institutions.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-126155 vulnerability?
CVE-2026-126155 is an incorrect authorization flaw (CWE-863) in Fortinet FortiMail that allows obtaining the IBE webmail session of any recipient. CVSS score: 9.1.
Does exploiting CVE-2026-126155 require authentication?
No. The attack is remote and requires no authentication or user interaction.
How to protect against CVE-2026-126155?
Update FortiMail as per advisory FG-IR-26-207 and restrict access to the device interfaces.
Who is affected by CVE-2026-126155?
Organizations running FortiMail 7.2–8.0.1 with IBE encryption.
