FortiMail (7.4.0-7.4.7) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/fortimail-7.4.0-7.4.7/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 02:09:28 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgFortinet FortiMail: Password recovery account takeover (CVE-2026-126150)https://feed.craftedsignal.io/briefs/2026-11-fortimail-password-reset-cve-2026-126150/Thu, 12 Nov 2026 02:09:28 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-fortimail-password-reset-cve-2026-126150/A weak password recovery mechanism in Fortinet FortiMail allows unauthenticated attackers to perform account takeovers of IBE webmail users via specially crafted HTTP requests.Fortinet FortiMail contains a vulnerability in its password recovery mechanism for forgotten passwords (CVE-2026-126150). An unauthenticated attacker can exploit this flaw by sending specially crafted HTTP requests to the IBE (Identity-Based Encryption) webmail component. Successful exploitation allows the attacker to reset the password of any IBE webmail user and gain full unauthorized access to their account.

Impact

This vulnerability allows for unauthenticated remote account takeover of any IBE webmail user on affected FortiMail systems, leading to potential unauthorized access to sensitive communications and data associated with those accounts.

Recommendation

  • Identify all internet-facing or internal instances of Fortinet FortiMail.
  • Immediately review the vendor advisory associated with CVE-2026-126150 to identify the required security updates.
  • Update affected versions of FortiMail (8.0.0, 7.6.0-7.6.5, 7.4.0-7.4.7, 7.2.0-7.2.9) to the patched releases provided by Fortinet.
  • Monitor FortiMail web server access logs for anomalous request patterns targeting the IBE password recovery endpoint.
]]>criticaladvisorycve-2026-126150vulnerabilitywebserveraccount-takeover