Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-126157 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-12 |
| Vendor | Fortinet |
| Product | FortiMail |
| Vulnerability Type | improper authentication (CWE-287) |
| CVSS Score | 9.1 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
An improper authentication vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8 and 7.2 all versions may allow an unauthenticated attacker to gain access to other users’ secure email accounts via crafted HTTP requests.
Secure email accounts are used to receive encrypted messages through the FortiMail webmail portal, usually reachable from the internet. The flaw breaks the confidentiality and integrity of that mail.
Required Actions
- Update FortiMail to the version listed in Fortinet advisory FG-IR-26-209.
- If you do not use IBE encryption, disable it; if you do — until patched, monitor IBE portal logs for password resets and logins from unusual addresses.
Who Is Affected?
The vulnerability affects Fortinet FortiMail 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8 and all 7.2 versions. FortiMail is an email security gateway, typically exposed to the internet (SMTP, webmail) and used by enterprises and public institutions.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-126157 vulnerability?
CVE-2026-126157 is an improper authentication flaw (CWE-287) in Fortinet FortiMail that allows access to other users' secure email accounts. CVSS score: 9.1.
Does exploiting CVE-2026-126157 require authentication?
No. The attack requires no authentication or user interaction.
How to protect against CVE-2026-126157?
Update FortiMail as per advisory FG-IR-26-209 and restrict access to the device interfaces.
Who is affected by CVE-2026-126157?
Organizations running FortiMail 7.2–8.0.1.
