{"id":"CVE-2026-126157","kind":"vulnerability","aliases":["CVE-2026-126157"],"related":[],"title":"Fortinet FortiMail: crafted HTTP requests let attackers reach other users' email","description":"A improper authentication vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to gain access to other users' secure email accounts via crafted HTTP requests.","summary":"FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all 7.2 versions have an improper authentication flaw. An unauthenticated attacker can send crafted HTTP requests to gain access to other users' secure email accounts.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiMail","fixed":["8.0.2"],"affected":">= 8.0.0, <= 8.0.1","ecosystem":"vendor"},{"name":"FortiMail 7.6","fixed":["7.6.7"],"affected":">= 7.6.0, <= 7.6.6","ecosystem":"vendor"},{"name":"FortiMail 7.4","fixed":["7.4.9"],"affected":">= 7.4.0, <= 7.4.8","ecosystem":"vendor"},{"name":"FortiMail 7.2","fixed":[],"affected":"all versions","ecosystem":"vendor"},{"name":"FortiMail 7.0","fixed":[],"affected":"all versions","ecosystem":"vendor"}],"ecosystems":[],"tags":["email-security","fortimail","fortinet","infrastructure","self-hosted"],"not_affected_if":["fortimail-cloud","patched-version","version-outside-affected-ranges"],"how_to_check":"Get the FortiMail firmware version (admin GUI dashboard or CLI 'get system status'). Exposed if it is 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, or any 7.2 or 7.0. Not exposed on 8.0.2+, 7.6.7+, 7.4.9+ or FortiMail Cloud. Fortinet's advisory says the attack is crafted HTTP requests with no authentication; it does not name the paths or settings, so treat any appliance whose web/HTTP service is reachable by untrusted networks as most at risk. No virtual patch exists.","fix":"Upgrade FortiMail 8.0 to 8.0.2, 7.6 to 7.6.7, 7.4 to 7.4.9. FortiMail 7.2 and 7.0 (all versions) have no fixed 7.x build: Fortinet says to migrate to a fixed release. FortiMail Cloud was already updated by Fortinet on Oct 5, 2026; no action.","status":"open","published_at":"2026-11-11T22:17:13+00:00","first_seen_at":"2026-11-11T22:29:28+00:00","triaged_at":"2026-11-11T22:31:09+00:00","updated_at":"2026-11-11T22:33:32+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-11T22:31:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Fortinet FortiMail: crafted HTTP requests let attackers reach other users' email","impact":"high","summary":"FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all 7.2 versions have an improper authentication flaw. An unauthenticated attacker can send crafted HTTP requests to gain access to other users' secure email accounts.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortimail","email-security","fortinet"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker reads other users' secure email without credentials","analyst_note":"Confirm the fixed versions and whether the HTTP interface must be exposed, using the Fortinet PSIRT advisory for CVE-2026-126157.","how_to_check":"- Check the installed FortiMail version in the admin web interface or with the vendor's CLI and compare it with the affected ranges listed above.\n- Confirm whether the FortiMail web interface is reachable from the internet.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-outside-affected-ranges"],"who_is_affected":"FortiMail appliances in the affected version ranges are exposed when their HTTP interface is reachable by an attacker. Teams that run FortiMail behind a restricted management network or on a version outside these ranges can deprioritise it. The sources do not say which HTTP paths or configurations are required.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000752,"input_tokens":4602,"output_tokens":584,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed versions and whether the HTTP interface must be exposed, using the Fortinet PSIRT advisory for CVE-2026-126157.","search":"'-126157':14A,17A '-2026':13A,16A '7.0':26A '7.2':24A,48B,91C '7.4':22A '7.4.0':43B,87C '7.4.8':45B,89C '7.6':20A '7.6.0':40B,83C '7.6.6':42B,85C '8.0.0':37B,79C '8.0.1':39B,81C 'access':65B,101C 'account':71B,107C 'allow':95C 'attack':7A,57B,98C 'authent':53B,74C 'craft':3A,60B,109C 'cve':12A,15A 'email':11A,28B,70B,106C 'email-secur':27B 'flaw':54B 'fortimail':2A,18A,19A,21A,23A,25A,30B,36B,78C,82C,86C,90C 'fortinet':1A,31B,77C 'gain':64B,100C 'host':35B 'http':4A,61B,110C 'improp':52B,73C 'infrastructur':32B 'let':6A 'may':94C 'reach':8A 'request':5A,62B,111C 'secur':29B,69B,105C 'self':34B 'self-host':33B 'send':59B 'unauthent':56B,97C 'user':10A,68B,104C 'version':49B,93C 'via':108C 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted FortiMail appliances or VMs on 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, and all 7.2 and 7.0 are affected: an unauthenticated attacker can send crafted HTTP requests to reach other users' secure email accounts. Fortinet does not say which HTTP paths or settings are required. FortiMail Cloud customers can skip it (already fixed Oct 5, 2026), as can anyone on 8.0.2, 7.6.7 or 7.4.9 or later.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:33:32Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-209","run_id":3606},"products":{"at":"2026-11-11T22:33:32Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-209","run_id":3606},"how_to_check":{"at":"2026-11-11T22:33:32Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-209","run_id":3606}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["70","72","74","76","fortimail","fortimail70","fortimail72","fortimail74","fortimail76"],"ptokens":["fortimail"],"labels":["critical","emailsecurity","fortimail","fortinet","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-126157':14A,17A '-2026':13A,16A '7.0':26A '7.2':24A '7.4':22A '7.6':20A 'attack':7A 'craft':3A 'cve':12A,15A 'email':11A 'fortimail':2A,18A,19A,21A,23A,25A 'fortinet':1A 'http':4A 'let':6A 'reach':8A 'request':5A 'user':10A","search_b":"'7.2':48B '7.4.0':43B '7.4.8':45B '7.6.0':40B '7.6.6':42B '8.0.0':37B '8.0.1':39B 'access':65B 'account':71B 'attack':57B 'authent':53B 'craft':60B 'email':28B,70B 'email-secur':27B 'flaw':54B 'fortimail':30B,36B 'fortinet':31B 'gain':64B 'host':35B 'http':61B 'improp':52B 'infrastructur':32B 'request':62B 'secur':29B,69B 'self':34B 'self-host':33B 'send':59B 'unauthent':56B 'user':68B 'version':49B","search_c":"'7.2':91C '7.4.0':87C '7.4.8':89C '7.6.0':83C '7.6.6':85C '8.0.0':79C '8.0.1':81C 'access':101C 'account':107C 'allow':95C 'attack':98C 'authent':74C 'craft':109C 'email':106C 'fortimail':78C,82C,86C,90C 'fortinet':77C 'gain':100C 'http':110C 'improp':73C 'may':94C 'request':111C 'secur':105C 'unauthent':97C 'user':104C 'version':93C 'via':108C 'vulner':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126157","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126157","severity":null,"published_at":"2026-11-11T22:17:13+00:00","modified_at":"2026-11-11T22:17:13+00:00","first_seen_at":"2026-11-11T22:29:28+00:00","fetched_at":"2026-11-11T22:29:28+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126157:3606","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-209","severity":null,"published_at":"2026-11-11T22:33:32+00:00","modified_at":"2026-11-11T22:33:32+00:00","first_seen_at":"2026-11-11T22:33:32+00:00","fetched_at":"2026-11-11T22:33:32+00:00","note":"Read Fortinet PSIRT FG-IR-26-209: fixed 8.0.2/7.6.7/7.4.9, 7.2 and 7.0 migrate; Cloud already fixed. Exposure condition (HTTP paths) not stated; no exploitation or PoC stated. Social search skipped; no mitigations/workarounds listed (virtual patch: No).","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-209"]}],"documents":[{"id":129648,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-209","title":"Fortinet PSIRT FG-IR-26-209: Missing authentication for critical function (FortiMail)","kind":"advisory","source":"analyst","publisher":null,"text":"A missing authentication for critical function vulnerability [CWE-306] in FortiMail may allow an unauthenticated attacker to gain access to other users' secure email accounts via crafted HTTP requests. Affected/solution: 8.0.0-8.0.1 -> 8.0.2; 7.6.0-7.6.6 -> 7.6.7; 7.4.0-7.4.8 -> 7.4.9; 7.2 all and 7.0 all -> migrate to a fixed release. FortiMail Cloud remediated on Oct 05, 2026 (v7.6.7 / v8.0.2), no customer action. Virtual patch: No. Published 2026-11-10. Discovered internally by Gwendal Guegniaud, Fortinet Product Security, using Claude Mythos.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}