Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-126156 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-12 |
| Vendor | Fortinet |
| Product | FortiMail |
| Vulnerability Type | authorization bypass through user-controlled key (CWE-639) |
| CVSS Score | 9.1 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
An authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8 and 7.2 all versions may allow an unauthenticated remote attacker to take over an arbitrary IBE recipient account via crafted HTTP requests.
IBE (Identity-Based Encryption) is the FortiMail mail encryption feature in which external recipients read encrypted messages via a webmail portal. The portal has to be reachable from the internet, which increases exposure. Account takeover gives access to the recipient’s encrypted mail.
Required Actions
- Update FortiMail to the version listed in Fortinet advisory FG-IR-26-208.
- If you do not use IBE encryption, disable it; if you do — until patched, monitor IBE portal logs for password resets and logins from unusual addresses.
Who Is Affected?
The vulnerability affects Fortinet FortiMail 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8 and all 7.2 versions with IBE encryption enabled. FortiMail is an email security gateway, typically exposed to the internet (SMTP, webmail) and used by enterprises and public institutions.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-126156 vulnerability?
CVE-2026-126156 is an authorization bypass through user-controlled key flaw (CWE-639) in Fortinet FortiMail that allows taking over any IBE recipient account. CVSS score: 9.1.
Does exploiting CVE-2026-126156 require authentication?
No. The attack is remote and requires no authentication or user interaction.
How to protect against CVE-2026-126156?
Update FortiMail as per advisory FG-IR-26-208 and restrict access to the device interfaces.
Who is affected by CVE-2026-126156?
Organizations running FortiMail 7.2–8.0.1 with IBE encryption.
