---
id: "CVE-2026-126151"
page: "https://infrastack.ai/live/CVE-2026-126151"
kind: "vulnerability"
aliases: ["CVE-2026-126151"]
title: "Fortinet FortiMail: flawed authentication lets remote attackers take over accounts"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "FortiMail", "fixed": ["8.0.2", "7.6.7", "7.4.9"], "affected": ">= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.6; >= 7.4.0, <= 7.4.8; 7.2 all versions", "ecosystem": "vendor"}]
ecosystems: []
tags: ["email-security", "fortimail", "fortinet", "infrastructure", "self-hosted"]
not_affected_if: ["fortimail-cloud", "version-outside-listed-ranges"]
published_at: "2026-11-11T22:17:12+00:00"
first_seen_at: "2026-11-11T22:29:28+00:00"
updated_at: "2026-11-11T22:48:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126151", "first_seen_at": "2026-11-11T22:29:28+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-203", "first_seen_at": "2026-11-11T22:48:46+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-203"]}]
exploit_sources: []
---

# Fortinet FortiMail: flawed authentication lets remote attackers take over accounts

Link for people: https://infrastack.ai/live/CVE-2026-126151 (this .md is for agents)

FortiMail mail appliances implement an authentication algorithm incorrectly. An unauthenticated remote attacker can send a crafted request to gain elevated privileges and take over accounts.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiMail affected >= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.6; >= 7.4.0, <= 7.4.8; 7.2 all versions fixed 8.0.2, 7.6.7, 7.4.9

## How to check

Check the FortiMail version in the admin interface or with 'get system status'. Exposed if it is 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, or any 7.2. FortiMail Cloud needs no action.

## Fix

Upgrade FortiMail to 8.0.2 or above (8.0.x), 7.6.7 or above (7.6.x), 7.4.9 or above (7.4.x). FortiMail 7.2 has no fixed 7.2 release: migrate to a fixed release (7.4.9+ / 7.6.7+ / 8.0.2+).

## Timeline

- 2026-11-11T22:29:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126151
- 2026-11-11T22:48:46+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-203 — Read Fortinet PSIRT FG-IR-26-203: fixed versions confirmed, not exploited per vendor, no virtual patch. Advisory page's title/summary says 'FortiWeb' (apparent typo) but its table and CVE ID are FortiMail. Page lists impact as 'Denial of service' while summary says account takeover; left as the summary states. NVD CVSS 7.5 vector is confidentiality-only. No posts searched (new, low profile).

## Documents

- [advisory] Fortinet PSIRT FG-IR-26-203 (CVE-2026-126151) https://fortiguard.fortinet.com/psirt/FG-IR-26-203

## From the sources

A incorrect implementation of authentication algorithm vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to gain elevation of privilege (account takeover) via a crafted request.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_