#fortimail
8 articles
CVE-2026-126147: Path Traversal in Fortinet FortiMail
A path traversal flaw in FortiMail 7.2–8.0.1 lets an unauthenticated attacker execute unauthorized code or commands via crafted requests...
CVE-2026-126148: OS Command Injection in Fortinet FortiMail HA
An OS command injection in FortiMail 7.6.0–7.6.6 and 8.0.0–8.0.1 lets an unauthenticated attacker execute code via crafted HA join-request packets...
CVE-2026-126150: Weak Password Recovery in Fortinet FortiMail IBE
A weak password recovery mechanism in FortiMail 7.2–8.0.0 lets an unauthenticated attacker reset the password of any IBE webmail user and take over the account...
CVE-2026-126155: Incorrect Authorization in Fortinet FortiMail IBE
An incorrect authorization flaw in FortiMail 7.2–8.0.1 lets a remote unauthenticated attacker obtain any IBE recipient webmail session and read or send their mail...
CVE-2026-126156: Authorization Bypass in Fortinet FortiMail IBE
An authorization bypass in FortiMail 7.2–8.0.1 lets a remote unauthenticated attacker take over any IBE recipient account via crafted HTTP requests...
CVE-2026-126157: Improper Authentication in Fortinet FortiMail
An improper authentication flaw in FortiMail 7.2–8.0.1 lets an unauthenticated attacker access other users' secure email accounts via crafted HTTP requests...
CVE-2026-126164: SQL Injection in Fortinet FortiMail
An SQL injection in FortiMail 7.2–8.0.1 lets an unauthenticated attacker execute unauthorized code or commands via crafted requests...
CVE-2026-126263: SQL Injection in Fortinet FortiMail
An SQL injection in FortiMail 7.4.0–7.4.6, 7.6.0–7.6.4 and 8.0.0–8.0.1 lets an authenticated attacker execute unauthorized code or commands...