https://feed.craftedsignal.io/products/fortimail-7.2.x/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 00:12:09 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-11-fortimail-auth-bypass-cve-2026-126160/Thu, 12 Nov 2026 00:12:09 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-fortimail-auth-bypass-cve-2026-126160/An improper authentication vulnerability in Fortinet FortiMail allows unauthenticated attackers to perform unauthorized actions on quarantined messages by sending crafted requests.Fortinet FortiMail contains an improper authentication vulnerability (CVE-2026-126160) affecting versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all versions in the 7.2 release branch. An unauthenticated attacker can exploit this flaw to escalate privileges and either release or delete quarantined messages for arbitrary mailboxes by submitting crafted quarantine release requests to the appliance.

Impact

Successful exploitation allows an unauthenticated attacker to manipulate quarantined mail content for any user, potentially leading to the unauthorized disclosure or deletion of sensitive intercepted communications. The vulnerability is rated with a CVSS v3.1 base score of 8.2.

Recommendation

Identify all instances of Fortinet FortiMail in the environment and verify current firmware versions against the vulnerable ranges. Prioritize applying patches provided by Fortinet as soon as they become available to remediate this vulnerability. Until updates are applied, monitor for unusual spikes in quarantine release or deletion activity within the appliance management interface logs.

]]>highadvisoryhttps://feed.craftedsignal.io/briefs/2026-11-fortinet-fortimail-auth-bypass-cve-2026-126155/Thu, 12 Nov 2026 00:11:21 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-fortinet-fortimail-auth-bypass-cve-2026-126155/An incorrect authorization vulnerability in Fortinet FortiMail allows an unauthenticated attacker to hijack Identity-Based Encryption (IBE) webmail sessions and access or send encrypted messages via crafted HTTP requests.Fortinet FortiMail is affected by an incorrect authorization vulnerability (CVE-2026-126155) that enables unauthenticated remote attackers to obtain an authenticated session for the Identity-Based Encryption (IBE) webmail portal. By sending specifically crafted HTTP requests to the target system, an attacker can impersonate any IBE recipient, granting unauthorized access to read encrypted mail or send mail on behalf of the victim.

Impact

Successful exploitation allows unauthorized access to sensitive encrypted communications and the ability to send emails as legitimate users, potentially leading to information disclosure and business process compromise. The vulnerability is rated with a CVSS v3.1 base score of 9.1.

Recommendation

Inventory all instances of Fortinet FortiMail running version 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, or any version of 7.2. Ensure these systems are prioritized for security updates according to Fortinet guidance. Monitor web server logs for anomalous HTTP requests directed at the IBE webmail portal, specifically focusing on unusual session parameters or unauthorized access attempts from public-facing interfaces.

]]>criticaladvisory