FORTIMAIL · CVE-2026-126157 · Infrastructure
FIX → 8.0.2 · 7.6.7 · 7.4.9 ✓ verified
FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all 7.2 versions have an improper authentication flaw. An unauthenticated attacker can send crafted HTTP requests to gain access to other users' secure email accounts.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-hosted FortiMail appliances or VMs on 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, and all 7.2 and 7.0 are affected: an unauthenticated attacker can send crafted HTTP requests to reach other users' secure email accounts. Fortinet does not say which HTTP paths or settings are required. FortiMail Cloud customers can skip it (already fixed Oct 5, 2026), as can anyone on 8.0.2, 7.6.7 or 7.4.9 or later.
Not affected if fortimail-cloud, patched-version, version-outside-affected-ranges
Who cares email-security, fortimail, fortinet, self-hosted
A improper authentication vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to gain access to other users' secure email accounts via crafted HTTP requests.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
get system status)8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, or any 7.2 or 7.0Upgrade to 8.0.2 · 7.6.7 · 7.4.9
8.0.2, 7.6 to 7.6.7, 7.4 to 7.4.9