{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/fortimail-7.4.0-7.4.7/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-126150"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FortiMail (8.0.0)","FortiMail (7.6.0-7.6.5)","FortiMail (7.4.0-7.4.7)","FortiMail (7.2.0-7.2.9)"],"_cs_severities":["critical"],"_cs_tags":["cve-2026-126150","vulnerability","webserver","account-takeover"],"_cs_type":"advisory","_cs_vendors":["Fortinet"],"content_html":"\u003cp\u003eFortinet FortiMail contains a vulnerability in its password recovery mechanism for forgotten passwords (CVE-2026-126150). An unauthenticated attacker can exploit this flaw by sending specially crafted HTTP requests to the IBE (Identity-Based Encryption) webmail component. Successful exploitation allows the attacker to reset the password of any IBE webmail user and gain full unauthorized access to their account.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability allows for unauthenticated remote account takeover of any IBE webmail user on affected FortiMail systems, leading to potential unauthorized access to sensitive communications and data associated with those accounts.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all internet-facing or internal instances of Fortinet FortiMail.\u003c/li\u003e\n\u003cli\u003eImmediately review the vendor advisory associated with CVE-2026-126150 to identify the required security updates.\u003c/li\u003e\n\u003cli\u003eUpdate affected versions of FortiMail (8.0.0, 7.6.0-7.6.5, 7.4.0-7.4.7, 7.2.0-7.2.9) to the patched releases provided by Fortinet.\u003c/li\u003e\n\u003cli\u003eMonitor FortiMail web server access logs for anomalous request patterns targeting the IBE password recovery endpoint.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-12T02:09:28Z","date_published":"2026-11-12T02:09:28Z","id":"https://feed.craftedsignal.io/briefs/2026-11-fortimail-password-reset-cve-2026-126150/","summary":"A weak password recovery mechanism in Fortinet FortiMail allows unauthenticated attackers to perform account takeovers of IBE webmail users via specially crafted HTTP requests.","title":"Fortinet FortiMail: Password recovery account takeover (CVE-2026-126150)","url":"https://feed.craftedsignal.io/briefs/2026-11-fortimail-password-reset-cve-2026-126150/"}],"language":"en","title":"CraftedSignal Threat Feed - FortiMail (7.4.0-7.4.7)","version":"https://jsonfeed.org/version/1.1"}