Fortinet FortiMail: Authentication Algorithm Incorrect Implementation (CVE-2026-126151)
An incorrect implementation of the authentication algorithm in Fortinet FortiMail versions 7.2, 7.4.0-7.4.8, 7.6.0-7.6.6, and 8.0.0-8.0.1 allows an unauthenticated remote attacker to gain elevation of privilege via a crafted request.
CVE search metadata
CVE search record: CVE-2026-126151. Severity: high. CVSS: 7.5. KEV: no. Product: FortiMail. Brief: Fortinet FortiMail: Authentication Algorithm Incorrect Implementation (CVE-2026-126151). Brief link: https://feed.craftedsignal.io/briefs/2026-11-fortinet-fortimail-auth-flaw-cve-2026-126151/
Triage facts
Revision 1- Applicability
- FortiMail
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 02:09 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
CVE-2026-126151 is a vulnerability in Fortinet FortiMail involving an incorrect implementation of the authentication algorithm. This flaw allows an unauthenticated remote attacker to gain elevation of privilege (account takeover) via a crafted request.
Impact
Successful exploitation may allow an unauthenticated remote attacker to perform an account takeover on the targeted FortiMail appliance.
Recommendation
Refer to official vendor documentation for guidance on mitigation and updates regarding CVE-2026-126151.