Skip to content
Threat Feed
Subscribe
critical advisory

Fortinet FortiMail: Password recovery account takeover (CVE-2026-126150)

A weak password recovery mechanism in Fortinet FortiMail allows unauthenticated attackers to perform account takeovers of IBE webmail users via specially crafted HTTP requests.

CVE search metadata

CVE search record: CVE-2026-126150. Severity: critical. CVSS: 9.1. KEV: no. Product: FortiMail (8.0.0), FortiMail (7.6.0-7.6.5), FortiMail (7.4.0-7.4.7), FortiMail (7.2.0-7.2.9). Brief: Fortinet FortiMail: Password recovery account takeover (CVE-2026-126150). Brief link: https://feed.craftedsignal.io/briefs/2026-11-fortimail-password-reset-cve-2026-126150/

Triage facts

Revision 1
Applicability
FortiMail (8.0.0), FortiMail (7.6.0-7.6.5) +2
Evidence
Unknown
Severity
Critical
Action
Immediate escalation
Sources
1 public source
Freshness
Revision 1Nov 12, 02:09 UTC
Vulnerabilities
1 CVE
Source quality
A1Very likely

Fortinet FortiMail contains a vulnerability in its password recovery mechanism for forgotten passwords (CVE-2026-126150). An unauthenticated attacker can exploit this flaw by sending specially crafted HTTP requests to the IBE (Identity-Based Encryption) webmail component. Successful exploitation allows the attacker to reset the password of any IBE webmail user and gain full unauthorized access to their account.

Impact

This vulnerability allows for unauthenticated remote account takeover of any IBE webmail user on affected FortiMail systems, leading to potential unauthorized access to sensitive communications and data associated with those accounts.

Recommendation

  • Identify all internet-facing or internal instances of Fortinet FortiMail.
  • Immediately review the vendor advisory associated with CVE-2026-126150 to identify the required security updates.
  • Update affected versions of FortiMail (8.0.0, 7.6.0-7.6.5, 7.4.0-7.4.7, 7.2.0-7.2.9) to the patched releases provided by Fortinet.
  • Monitor FortiMail web server access logs for anomalous request patterns targeting the IBE password recovery endpoint.

Immediate actions

Inventory all FortiMail deployments and apply vendor-provided security patches for CVE-2026-126150.

IT Operations 24h

Threat Hunt

Monitor FortiMail IBE webmail logs for repetitive or unusual POST requests to the password recovery URI structure.

T1589.002 high medium confidence hunt now

Data: FortiMail web access logs, HTTP request parameters