FortiMail 8.0.0 Through 8.0.1 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/fortimail-8.0.0-through-8.0.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 00:11:58 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgFortinet FortiMail: Authorization bypass via quarantine request (CVE-2026-126159)https://feed.craftedsignal.io/briefs/2026-11-fortimail-bypass-cve-2026-126159/Thu, 12 Nov 2026 00:11:58 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-fortimail-bypass-cve-2026-126159/An authorization bypass vulnerability in Fortinet FortiMail allows an unauthenticated attacker to release or delete quarantined messages for arbitrary mailboxes via a crafted request.Fortinet FortiMail contains an authorization bypass vulnerability (CVE-2026-126159) resulting from a user-controlled key. This allows an unauthenticated attacker to release or delete quarantined messages for arbitrary mailboxes by sending a crafted quarantine release request.

Impact

The vulnerability allows unauthorized manipulation of quarantined email messages. The CVSS v3.1 base score is 7.5.

Recommendation

Review environments for affected versions to determine upgrade requirements per official vendor guidance.

]]>highadvisoryFortinet FortiMail: Authorization bypass via user-controlled key (CVE-2026-126156)https://feed.craftedsignal.io/briefs/2026-11-fortimail-bypass-cve-2026-126156/Thu, 12 Nov 2026 00:11:29 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-fortimail-bypass-cve-2026-126156/An unauthenticated remote attacker can bypass authorization in Fortinet FortiMail to take over an arbitrary Identity-Based Encryption (IBE) recipient account by sending crafted HTTP requests.Fortinet FortiMail contains an authorization bypass vulnerability (CVE-2026-126156) stemming from a user-controlled key flaw. This vulnerability enables an unauthenticated remote attacker to gain control over an arbitrary Identity-Based Encryption (IBE) recipient account through specially crafted HTTP requests.

Impact

Successful exploitation allows an unauthenticated attacker to take over arbitrary IBE recipient accounts. The vulnerability has a CVSS v3.1 base score of 9.1.

]]>criticaladvisoryFortinet FortiMail Path Traversal (CVE-2026-126153)https://feed.craftedsignal.io/briefs/2026-11-fortinet-fortimail-path-traversal-cve-2026-126153/Thu, 12 Nov 2026 00:11:02 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-fortinet-fortimail-path-traversal-cve-2026-126153/CVE-2026-126153 is a path traversal vulnerability in multiple versions of Fortinet FortiMail that allows unauthenticated attackers to execute unauthorized commands via crafted requests.Fortinet FortiMail versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all versions of 7.2 are affected by an improper limitation of a pathname to a restricted directory vulnerability, also known as path traversal. This flaw allows an unauthenticated attacker to execute unauthorized commands via crafted requests.

Impact

Successful exploitation allows an unauthenticated attacker to execute unauthorized commands on the target appliance.

]]>highadvisory