---
id: "CVE-2026-126157"
page: "https://infrastack.ai/live/CVE-2026-126157"
kind: "vulnerability"
aliases: ["CVE-2026-126157"]
title: "Fortinet FortiMail: crafted HTTP requests let attackers reach other users' email"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "FortiMail", "fixed": ["8.0.2"], "affected": ">= 8.0.0, <= 8.0.1", "ecosystem": "vendor"}, {"name": "FortiMail 7.6", "fixed": ["7.6.7"], "affected": ">= 7.6.0, <= 7.6.6", "ecosystem": "vendor"}, {"name": "FortiMail 7.4", "fixed": ["7.4.9"], "affected": ">= 7.4.0, <= 7.4.8", "ecosystem": "vendor"}, {"name": "FortiMail 7.2", "fixed": [], "affected": "all versions", "ecosystem": "vendor"}, {"name": "FortiMail 7.0", "fixed": [], "affected": "all versions", "ecosystem": "vendor"}]
ecosystems: []
tags: ["email-security", "fortimail", "fortinet", "infrastructure", "self-hosted"]
not_affected_if: ["fortimail-cloud", "patched-version", "version-outside-affected-ranges"]
published_at: "2026-11-11T22:17:13+00:00"
first_seen_at: "2026-11-11T22:29:28+00:00"
updated_at: "2026-11-11T22:33:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126157", "first_seen_at": "2026-11-11T22:29:28+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-209", "first_seen_at": "2026-11-11T22:33:32+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-209"]}]
exploit_sources: []
---

# Fortinet FortiMail: crafted HTTP requests let attackers reach other users' email

Link for people: https://infrastack.ai/live/CVE-2026-126157 (this .md is for agents)

FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all 7.2 versions have an improper authentication flaw. An unauthenticated attacker can send crafted HTTP requests to gain access to other users' secure email accounts.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiMail affected >= 8.0.0, <= 8.0.1 fixed 8.0.2
- vendor:FortiMail 7.6 affected >= 7.6.0, <= 7.6.6 fixed 7.6.7
- vendor:FortiMail 7.4 affected >= 7.4.0, <= 7.4.8 fixed 7.4.9
- vendor:FortiMail 7.2 affected all versions fixed no fixed version listed
- vendor:FortiMail 7.0 affected all versions fixed no fixed version listed

## How to check

Get the FortiMail firmware version (admin GUI dashboard or CLI 'get system status'). Exposed if it is 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, or any 7.2 or 7.0. Not exposed on 8.0.2+, 7.6.7+, 7.4.9+ or FortiMail Cloud. Fortinet's advisory says the attack is crafted HTTP requests with no authentication; it does not name the paths or settings, so treat any appliance whose web/HTTP service is reachable by untrusted networks as most at risk. No virtual patch exists.

## Fix

Upgrade FortiMail 8.0 to 8.0.2, 7.6 to 7.6.7, 7.4 to 7.4.9. FortiMail 7.2 and 7.0 (all versions) have no fixed 7.x build: Fortinet says to migrate to a fixed release. FortiMail Cloud was already updated by Fortinet on Oct 5, 2026; no action.

## Timeline

- 2026-11-11T22:29:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126157
- 2026-11-11T22:33:32+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-209 — Read Fortinet PSIRT FG-IR-26-209: fixed 8.0.2/7.6.7/7.4.9, 7.2 and 7.0 migrate; Cloud already fixed. Exposure condition (HTTP paths) not stated; no exploitation or PoC stated. Social search skipped; no mitigations/workarounds listed (virtual patch: No).

## Documents

- [advisory] Fortinet PSIRT FG-IR-26-209: Missing authentication for critical function (FortiMail) https://fortiguard.fortinet.com/psirt/FG-IR-26-209

## From the sources

A improper authentication vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to gain access to other users' secure email accounts via crafted HTTP requests.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_