{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/fortimail-7.4.0-through-7.4.8/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-126167"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FortiMail 8.0.0 through 8.0.2","FortiMail 7.6.0 through 7.6.6","FortiMail 7.4.0 through 7.4.8","FortiMail 7.2"],"_cs_severities":["high"],"_cs_tags":["cve","vulnerability","network"],"_cs_type":"advisory","_cs_vendors":["Fortinet"],"content_html":"\u003cp\u003eFortinet FortiMail versions 8.0.0 through 8.0.2, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2 contain a command injection vulnerability (CVE-2026-126167) due to improper neutralization of special elements in the administrative interface. An attacker with domain admin or admin privileges can exploit this via crafted HTTP requests.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated attacker to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root, execute arbitrary CLI commands, and read or write arbitrary files as root.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eReview and audit administrative accounts and current session activity for all FortiMail instances.\u003c/li\u003e\n\u003cli\u003eMonitor administrative interface access logs for unusual HTTP request patterns from administrator accounts.\u003c/li\u003e\n\u003cli\u003eRestrict access to the FortiMail administrative interface to authorized networks and known management IP addresses.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-11-12T00:15:32Z","date_published":"2026-11-12T00:15:32Z","id":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-126167/","summary":"An authenticated remote command injection vulnerability in Fortinet FortiMail allows administrators to execute arbitrary commands as root and manipulate user accounts on paired FortiAuthenticator devices.","title":"Fortinet FortiMail: Command injection vulnerability (CVE-2026-126167)","url":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-126167/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-126166"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FortiMail 8.0.0 through 8.0.2","FortiMail 7.6.0 through 7.6.6","FortiMail 7.4.0 through 7.4.8","FortiMail 7.2 all versions"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Fortinet"],"content_html":"\u003cp\u003eCVE-2026-126166 is an improper neutralization of argument delimiters vulnerability in the administrative interface of Fortinet FortiMail. An authenticated remote attacker with domain admin or admin privileges can send crafted HTTP requests to perform arbitrary CLI commands, execute code as root, read or write arbitrary files, and delete users of other tenant domains on paired FortiAuthenticator instances.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows authenticated administrative users to gain root access to the affected appliance and manipulate user data on integrated authentication systems.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eReview administrative access to the FortiMail management interface and ensure only authorized personnel have high-level privileges.\u003c/p\u003e\n","date_modified":"2026-11-12T00:15:11Z","date_published":"2026-11-12T00:15:11Z","id":"https://feed.craftedsignal.io/briefs/2026-11-fortimail-argument-injection-cve-2026-126166/","summary":"An argument injection vulnerability in the administrative interface of Fortinet FortiMail allows authenticated remote attackers with admin privileges to achieve arbitrary code execution as root and perform unauthorized actions on paired FortiAuthenticator devices.","title":"Fortinet FortiMail Argument Injection Vulnerability (CVE-2026-126166)","url":"https://feed.craftedsignal.io/briefs/2026-11-fortimail-argument-injection-cve-2026-126166/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-126159"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FortiMail 8.0.0 through 8.0.1","FortiMail 7.6.0 through 7.6.6","FortiMail 7.4.0 through 7.4.8","FortiMail 7.2 all versions"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Fortinet"],"content_html":"\u003cp\u003eFortinet FortiMail contains an authorization bypass vulnerability (CVE-2026-126159) resulting from a user-controlled key. This allows an unauthenticated attacker to release or delete quarantined messages for arbitrary mailboxes by sending a crafted quarantine release request.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows unauthorized manipulation of quarantined email messages. The CVSS v3.1 base score is 7.5.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eReview environments for affected versions to determine upgrade requirements per official vendor guidance.\u003c/p\u003e\n","date_modified":"2026-11-12T00:11:58Z","date_published":"2026-11-12T00:11:58Z","id":"https://feed.craftedsignal.io/briefs/2026-11-fortimail-bypass-cve-2026-126159/","summary":"An authorization bypass vulnerability in Fortinet FortiMail allows an unauthenticated attacker to release or delete quarantined messages for arbitrary mailboxes via a crafted request.","title":"Fortinet FortiMail: Authorization bypass via quarantine request (CVE-2026-126159)","url":"https://feed.craftedsignal.io/briefs/2026-11-fortimail-bypass-cve-2026-126159/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-126156"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FortiMail 8.0.0 through 8.0.1","FortiMail 7.6.0 through 7.6.6","FortiMail 7.4.0 through 7.4.8","FortiMail 7.2 all versions"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Fortinet"],"content_html":"\u003cp\u003eFortinet FortiMail contains an authorization bypass vulnerability (CVE-2026-126156) stemming from a user-controlled key flaw. This vulnerability enables an unauthenticated remote attacker to gain control over an arbitrary Identity-Based Encryption (IBE) recipient account through specially crafted HTTP requests.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated attacker to take over arbitrary IBE recipient accounts. The vulnerability has a CVSS v3.1 base score of 9.1.\u003c/p\u003e\n","date_modified":"2026-11-12T00:11:29Z","date_published":"2026-11-12T00:11:29Z","id":"https://feed.craftedsignal.io/briefs/2026-11-fortimail-bypass-cve-2026-126156/","summary":"An unauthenticated remote attacker can bypass authorization in Fortinet FortiMail to take over an arbitrary Identity-Based Encryption (IBE) recipient account by sending crafted HTTP requests.","title":"Fortinet FortiMail: Authorization bypass via user-controlled key (CVE-2026-126156)","url":"https://feed.craftedsignal.io/briefs/2026-11-fortimail-bypass-cve-2026-126156/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-126153"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FortiMail 8.0.0 through 8.0.1","FortiMail 7.6.0 through 7.6.6","FortiMail 7.4.0 through 7.4.8","FortiMail 7.2 all versions"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Fortinet"],"content_html":"\u003cp\u003eFortinet FortiMail versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all versions of 7.2 are affected by an improper limitation of a pathname to a restricted directory vulnerability, also known as path traversal. This flaw allows an unauthenticated attacker to execute unauthorized commands via crafted requests.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated attacker to execute unauthorized commands on the target appliance.\u003c/p\u003e\n","date_modified":"2026-11-12T00:11:02Z","date_published":"2026-11-12T00:11:02Z","id":"https://feed.craftedsignal.io/briefs/2026-11-fortinet-fortimail-path-traversal-cve-2026-126153/","summary":"CVE-2026-126153 is a path traversal vulnerability in multiple versions of Fortinet FortiMail that allows unauthenticated attackers to execute unauthorized commands via crafted requests.","title":"Fortinet FortiMail Path Traversal (CVE-2026-126153)","url":"https://feed.craftedsignal.io/briefs/2026-11-fortinet-fortimail-path-traversal-cve-2026-126153/"}],"language":"en","title":"CraftedSignal Threat Feed - FortiMail 7.4.0 Through 7.4.8","version":"https://jsonfeed.org/version/1.1"}