{"id":"CVE-2026-126150","kind":"vulnerability","aliases":["CVE-2026-126150"],"related":[],"title":"Fortinet FortiMail: weak password reset lets attackers take over webmail accounts","description":"A weak password recovery mechanism for forgotten password vulnerability in Fortinet FortiMail 8.0.0, FortiMail 7.6.0 through 7.6.5, FortiMail 7.4.0 through 7.4.7, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to reset the password of an arbitrary IBE webmail user and take over their account via specially crafted HTTP requests.","summary":"FortiMail's password recovery for IBE webmail users can be abused with specially crafted HTTP requests to reset any user's password. An unauthenticated attacker who does this can take over the victim's account and read their encrypted mail.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiMail","fixed":["8.0.1","7.6.6","7.4.8","7.2.10 (upcoming)"],"affected":"8.0.0; >= 7.6.0, <= 7.6.5; >= 7.4.0, <= 7.4.7; >= 7.2.0, <= 7.2.9","ecosystem":"vendor"}],"ecosystems":[],"tags":["email-gateway","fortimail","ibe-webmail","self-hosted","vendor"],"not_affected_if":["fortimail-cloud","ibe-webmail-disabled","version-outside-listed-ranges"],"how_to_check":"- Run 'get system status' on the appliance (or check the admin dashboard) for the FortiMail version.\n- Exposed if running 8.0.0, 7.6.0-7.6.5, 7.4.0-7.4.7 or 7.2.0-7.2.9 and IBE webmail is reachable by recipients.\n- FortiMail Cloud customers need not act (Fortinet remediated Oct 5, 2026).\n- Also check the sibling FortiMail IBE advisories (FG-IR-26-207, FG-IR-26-208), which need 8.0.2 / 7.6.7 / 7.4.9.","fix":"Upgrade FortiMail 8.0.0 to 8.0.1+; 7.6.0-7.6.5 to 7.6.6+; 7.4.0-7.4.7 to 7.4.8+; 7.2.0-7.2.9 to upcoming 7.2.10 (not yet released per advisory). FortiMail Cloud was remediated by Fortinet on Oct 5, 2026; no customer action.","status":"open","published_at":"2026-11-11T22:17:12+00:00","first_seen_at":"2026-11-11T22:29:28+00:00","triaged_at":"2026-11-11T22:31:11+00:00","updated_at":"2026-11-11T22:33:22+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-11-11T22:31:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Fortinet FortiMail: weak password reset lets attackers take over webmail accounts","impact":"high","summary":"FortiMail's password recovery for IBE webmail users can be abused with specially crafted HTTP requests to reset any user's password. An unauthenticated attacker who does this can take over the victim's account and read their encrypted mail.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortimail","email-gateway","ibe-webmail"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker resets passwords and takes over IBE webmail accounts","analyst_note":"Find the Fortinet PSIRT advisory for CVE-2026-126150 to confirm the fixed versions and any setting that disables IBE webmail.","how_to_check":"- Check the FortiMail version under the admin dashboard or `get system status` on the appliance\n- Confirm whether IBE webmail is in use for recipients\n- Compare the running version with the affected ranges: 8.0.0, 7.6.0 through 7.6.5, 7.4.0 through 7.4.7, 7.2.0 through 7.2.9","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-outside-listed-ranges","ibe-webmail-disabled"],"who_is_affected":"Organizations running FortiMail appliances in the affected version ranges that offer IBE webmail to recipients. The flaw is reachable over HTTP without an account, so any FortiMail with IBE webmail exposed to the internet is in scope. Installations outside the listed ranges are not named by the source.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000771,"input_tokens":4618,"output_tokens":619,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the Fortinet PSIRT advisory for CVE-2026-126150 to confirm the fixed versions and any setting that disables IBE webmail.","search":"'-126150':14A,17A '-2026':13A,16A '7.2.0':92C '7.2.9':94C '7.4.0':88C '7.4.7':90C '7.6.0':84C '7.6.5':86C '8.0.0':82C 'abus':40B 'account':11A,64B,114C 'allow':96C 'arbitrari':106C 'attack':7A,54B,99C 'craft':43B,117C 'cve':12A,15A 'email':20B 'email-gateway':19B 'encrypt':68B 'forgotten':76C 'fortimail':2A,18A,22B,30B,81C,83C,87C,91C 'fortinet':1A,80C 'gateway':21B 'host':28B 'http':44B,118C 'ibe':24B,35B,107C 'ibe-webmail':23B 'let':6A 'mail':69B 'may':95C 'mechan':74C 'password':4A,32B,51B,72C,77C,103C 'read':66B 'recoveri':33B,73C 'request':45B,119C 'reset':5A,47B,101C 'self':27B 'self-host':26B 'special':42B,116C 'take':8A,59B,111C 'unauthent':53B,98C 'user':37B,49B,109C 'vendor':29B 'via':115C 'victim':62B 'vulner':78C 'weak':3A,71C 'webmail':10A,25B,36B,108C","nicknames":[],"mitigations":[],"who_affected":"Organizations running FortiMail appliances in the affected version ranges that offer IBE webmail to recipients. The flaw is reachable over HTTP without an account, so any FortiMail with IBE webmail exposed to the internet is in scope. Installations outside the listed ranges are not named by the source.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:33:22Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-202","run_id":3608},"products":{"at":"2026-11-11T22:33:22Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-202","run_id":3608},"who_affected":{"at":"2026-11-11T22:33:22Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-202","run_id":3608}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["fortimail"],"ptokens":["fortimail"],"labels":["critical","emailgateway","fortimail","ibewebmail","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126150':14A,17A '-2026':13A,16A 'account':11A 'attack':7A 'cve':12A,15A 'fortimail':2A,18A 'fortinet':1A 'let':6A 'password':4A 'reset':5A 'take':8A 'weak':3A 'webmail':10A","search_b":"'abus':40B 'account':64B 'attack':54B 'craft':43B 'email':20B 'email-gateway':19B 'encrypt':68B 'fortimail':22B,30B 'gateway':21B 'host':28B 'http':44B 'ibe':24B,35B 'ibe-webmail':23B 'mail':69B 'password':32B,51B 'read':66B 'recoveri':33B 'request':45B 'reset':47B 'self':27B 'self-host':26B 'special':42B 'take':59B 'unauthent':53B 'user':37B,49B 'vendor':29B 'victim':62B 'webmail':25B,36B","search_c":"'7.2.0':92C '7.2.9':94C '7.4.0':88C '7.4.7':90C '7.6.0':84C '7.6.5':86C '8.0.0':82C 'account':114C 'allow':96C 'arbitrari':106C 'attack':99C 'craft':117C 'forgotten':76C 'fortimail':81C,83C,87C,91C 'fortinet':80C 'http':118C 'ibe':107C 'may':95C 'mechan':74C 'password':72C,77C,103C 'recoveri':73C 'request':119C 'reset':101C 'special':116C 'take':111C 'unauthent':98C 'user':109C 'via':115C 'vulner':78C 'weak':71C 'webmail':108C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126150","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126150","severity":null,"published_at":"2026-11-11T22:17:12+00:00","modified_at":"2026-11-11T22:17:12+00:00","first_seen_at":"2026-11-11T22:29:28+00:00","fetched_at":"2026-11-11T22:29:28+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126150:3608","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-202","severity":null,"published_at":"2026-11-11T22:33:22+00:00","modified_at":"2026-11-11T22:33:22+00:00","first_seen_at":"2026-11-11T22:33:22+00:00","fetched_at":"2026-11-11T22:33:22+00:00","note":"Fortinet PSIRT FG-IR-26-202 (read directly) confirms CVE, ranges and fixed versions. Page lists no workaround; the IBE-off workaround is on a different advisory (FG-IR-26-175), not applied here. Not exploited per vendor. Sibling FortiMail IBE advisories published same day (FG-IR-26-207/208, CVE-2026-126155/126156) have different fixes (8.0.2/7.6.7/7.4.9).","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-202"]}],"documents":[{"id":129647,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-202","title":"Fortinet PSIRT FG-IR-26-202: Weak password recovery mechanism for forgotten password","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}