---
id: "CVE-2026-126150"
page: "https://infrastack.ai/live/CVE-2026-126150"
kind: "vulnerability"
aliases: ["CVE-2026-126150"]
title: "Fortinet FortiMail: weak password reset lets attackers take over webmail accounts"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "FortiMail", "fixed": ["8.0.1", "7.6.6", "7.4.8", "7.2.10 (upcoming)"], "affected": "8.0.0; >= 7.6.0, <= 7.6.5; >= 7.4.0, <= 7.4.7; >= 7.2.0, <= 7.2.9", "ecosystem": "vendor"}]
ecosystems: []
tags: ["email-gateway", "fortimail", "ibe-webmail", "self-hosted", "vendor"]
not_affected_if: ["fortimail-cloud", "ibe-webmail-disabled", "version-outside-listed-ranges"]
published_at: "2026-11-11T22:17:12+00:00"
first_seen_at: "2026-11-11T22:29:28+00:00"
updated_at: "2026-11-11T22:33:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126150", "first_seen_at": "2026-11-11T22:29:28+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-202", "first_seen_at": "2026-11-11T22:33:22+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-202"]}]
exploit_sources: []
---

# Fortinet FortiMail: weak password reset lets attackers take over webmail accounts

Link for people: https://infrastack.ai/live/CVE-2026-126150 (this .md is for agents)

FortiMail's password recovery for IBE webmail users can be abused with specially crafted HTTP requests to reset any user's password. An unauthenticated attacker who does this can take over the victim's account and read their encrypted mail.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiMail affected 8.0.0; >= 7.6.0, <= 7.6.5; >= 7.4.0, <= 7.4.7; >= 7.2.0, <= 7.2.9 fixed 8.0.1, 7.6.6, 7.4.8, 7.2.10 (upcoming)

## How to check

- Run 'get system status' on the appliance (or check the admin dashboard) for the FortiMail version.
- Exposed if running 8.0.0, 7.6.0-7.6.5, 7.4.0-7.4.7 or 7.2.0-7.2.9 and IBE webmail is reachable by recipients.
- FortiMail Cloud customers need not act (Fortinet remediated Oct 5, 2026).
- Also check the sibling FortiMail IBE advisories (FG-IR-26-207, FG-IR-26-208), which need 8.0.2 / 7.6.7 / 7.4.9.

## Fix

Upgrade FortiMail 8.0.0 to 8.0.1+; 7.6.0-7.6.5 to 7.6.6+; 7.4.0-7.4.7 to 7.4.8+; 7.2.0-7.2.9 to upcoming 7.2.10 (not yet released per advisory). FortiMail Cloud was remediated by Fortinet on Oct 5, 2026; no customer action.

## Timeline

- 2026-11-11T22:29:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126150
- 2026-11-11T22:33:22+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-202 — Fortinet PSIRT FG-IR-26-202 (read directly) confirms CVE, ranges and fixed versions. Page lists no workaround; the IBE-off workaround is on a different advisory (FG-IR-26-175), not applied here. Not exploited per vendor. Sibling FortiMail IBE advisories published same day (FG-IR-26-207/208, CVE-2026-126155/126156) have different fixes (8.0.2/7.6.7/7.4.9).

## Documents

- [advisory] Fortinet PSIRT FG-IR-26-202: Weak password recovery mechanism for forgotten password https://fortiguard.fortinet.com/psirt/FG-IR-26-202

## From the sources

A weak password recovery mechanism for forgotten password vulnerability in Fortinet FortiMail 8.0.0, FortiMail 7.6.0 through 7.6.5, FortiMail 7.4.0 through 7.4.7, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to reset the password of an arbitrary IBE webmail user and take over their account via specially crafted HTTP requests.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_