Fortinet FortiMail: Improper authentication vulnerability (CVE-2026-126160)
An improper authentication vulnerability in Fortinet FortiMail allows unauthenticated attackers to perform unauthorized actions on quarantined messages by sending crafted requests.
CVE search metadata
CVE search record: CVE-2026-126160. Severity: high. CVSS: 8.2. KEV: no. Product: FortiMail (8.0.0-8.0.1), FortiMail (7.6.0-7.6.6), FortiMail (7.4.0-7.4.8), FortiMail (7.2.x). Brief: Fortinet FortiMail: Improper authentication vulnerability (CVE-2026-126160). Brief link: https://feed.craftedsignal.io/briefs/2026-11-fortimail-auth-bypass-cve-2026-126160/
Triage facts
Revision 1- Applicability
- FortiMail (8.0.0-8.0.1), FortiMail (7.6.0-7.6.6) +2
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 00:12 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Fortinet FortiMail contains an improper authentication vulnerability (CVE-2026-126160) affecting versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all versions in the 7.2 release branch. An unauthenticated attacker can exploit this flaw to escalate privileges and either release or delete quarantined messages for arbitrary mailboxes by submitting crafted quarantine release requests to the appliance.
Impact
Successful exploitation allows an unauthenticated attacker to manipulate quarantined mail content for any user, potentially leading to the unauthorized disclosure or deletion of sensitive intercepted communications. The vulnerability is rated with a CVSS v3.1 base score of 8.2.
Recommendation
Identify all instances of Fortinet FortiMail in the environment and verify current firmware versions against the vulnerable ranges. Prioritize applying patches provided by Fortinet as soon as they become available to remediate this vulnerability. Until updates are applied, monitor for unusual spikes in quarantine release or deletion activity within the appliance management interface logs.
Immediate actions
Inventory all FortiMail appliances and identify versions currently running the affected releases.
Threat Hunt
Investigate FortiMail management or web logs for a sudden volume of quarantine release or deletion requests originating from unknown or unauthorized internal sources.
Data: FortiMail management logs, Web access logs
Mitigations
Apply the latest security updates released by Fortinet for affected FortiMail versions.
CVE-2026-126160