Fortinet FortiMail: Improper Authentication Vulnerability (CVE-2026-126157)
An improper authentication vulnerability in Fortinet FortiMail allows unauthenticated attackers to gain unauthorized access to secure email accounts via crafted HTTP requests.
CVE search metadata
CVE search record: CVE-2026-126157. Severity: critical. CVSS: 9.1. KEV: no. Product: FortiMail. Brief: Fortinet FortiMail: Improper Authentication Vulnerability (CVE-2026-126157). Brief link: https://feed.craftedsignal.io/briefs/2026-11-fortimail-auth-cve-2026-126157/
Triage facts
Revision 1- Applicability
- FortiMail
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 00:11 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
CVE-2026-126157 is an improper authentication vulnerability in Fortinet FortiMail that may allow an unauthenticated attacker to gain access to other users' secure email accounts via crafted HTTP requests.
Impact
Successful exploitation allows unauthenticated attackers to access secure email accounts on vulnerable FortiMail instances.
Affected Products
- FortiMail 8.0.0 through 8.0.1
- FortiMail 7.6.0 through 7.6.6
- FortiMail 7.4.0 through 7.4.8
- FortiMail 7.2 all versions