{"id":"CVE-2026-126160","kind":"vulnerability","aliases":["CVE-2026-126160"],"related":[],"title":"Fortinet FortiMail: unauthenticated users can release or delete quarantined mail","description":"A improper authentication vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to escalate privileges and release or delete quarantined messages for arbitrary mailboxes via a crafted quarantine release requests.","summary":"A missing authentication check in FortiMail lets an unauthenticated attacker send crafted quarantine requests. The attacker can escalate privileges and release or delete quarantined messages for any mailbox.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["email-security","fortimail","fortinet","vendor"],"not_affected_if":["unaffected-version"],"how_to_check":"- Check the FortiMail firmware version under the system dashboard against the affected ranges: `8.0.0` through `8.0.1`, `7.6.0` through `7.6.6`, `7.4.0` through `7.4.8`, and all `7.2` versions.","fix":"- Move FortiMail 8.0 to a fixed release (the sources do not name the fixed version).\n- Move FortiMail 7.6, 7.4 and 7.2 to a fixed release (the sources do not name the fixed versions).","status":"open","published_at":"2026-11-11T22:17:13+00:00","first_seen_at":"2026-11-11T22:29:28+00:00","triaged_at":"2026-11-11T22:31:41+00:00","updated_at":"2026-11-11T22:31:41+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-11T22:31:41Z","model":"claude-haiku-5-5","output":{"fix":"- Move FortiMail 8.0 to a fixed release (the sources do not name the fixed version).\n- Move FortiMail 7.6, 7.4 and 7.2 to a fixed release (the sources do not name the fixed versions).","reach":"unknown","title":"Fortinet FortiMail: unauthenticated users can release or delete quarantined mail","impact":"high","summary":"A missing authentication check in FortiMail lets an unauthenticated attacker send crafted quarantine requests. The attacker can escalate privileges and release or delete quarantined messages for any mailbox.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortimail","email-security","fortinet"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker reads, releases or deletes quarantined email for any mailbox.","analyst_note":"Find the Fortinet PSIRT advisory for CVE-2026-126160 to confirm fixed versions and whether the quarantine interface is internet-exposed.","how_to_check":"- Check the FortiMail firmware version under the system dashboard against the affected ranges: `8.0.0` through `8.0.1`, `7.6.0` through `7.6.6`, `7.4.0` through `7.4.8`, and all `7.2` versions.\n- unknown for other checks; the sources do not say which logs or settings show exploitation.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Organizations running FortiMail email security appliances or VMs in the affected version ranges. The sources do not say whether management or quarantine interfaces must be reachable from the internet for exploitation, so treat any exposed quarantine interface as at risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000787,"input_tokens":4618,"output_tokens":650,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126160':13A,16A '-2026':12A,15A '7.2':70C '7.4.0':66C '7.4.8':68C '7.6.0':62C '7.6.6':64C '8.0.0':58C '8.0.1':60C 'allow':74C 'arbitrari':88C 'attack':32B,38B,77C 'authent':25B,53C 'check':26B 'craft':34B,92C 'cve':11A,14A 'delet':8A,45B,84C 'email':18B 'email-secur':17B 'escal':40B,79C 'fortimail':2A,20B,28B,57C,61C,65C,69C 'fortinet':1A,21B,56C 'improp':52C 'let':29B 'mail':10A 'mailbox':50B,89C 'may':73C 'messag':47B,86C 'miss':24B 'privileg':41B,80C 'quarantin':9A,35B,46B,85C,93C 'releas':6A,43B,82C,94C 'request':36B,95C 'secur':19B 'send':33B 'unauthent':3A,31B,76C 'user':4A 'vendor':22B 'version':72C 'via':90C 'vulner':54C","nicknames":[],"mitigations":[],"who_affected":"Organizations running FortiMail email security appliances or VMs in the affected version ranges. The sources do not say whether management or quarantine interfaces must be reachable from the internet for exploitation, so treat any exposed quarantine interface as at risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["emailsecurity","fortimail","fortinet","high","vendor"],"campaign_type":null,"search_a":"'-126160':13A,16A '-2026':12A,15A 'cve':11A,14A 'delet':8A 'fortimail':2A 'fortinet':1A 'mail':10A 'quarantin':9A 'releas':6A 'unauthent':3A 'user':4A","search_b":"'attack':32B,38B 'authent':25B 'check':26B 'craft':34B 'delet':45B 'email':18B 'email-secur':17B 'escal':40B 'fortimail':20B,28B 'fortinet':21B 'let':29B 'mailbox':50B 'messag':47B 'miss':24B 'privileg':41B 'quarantin':35B,46B 'releas':43B 'request':36B 'secur':19B 'send':33B 'unauthent':31B 'vendor':22B","search_c":"'7.2':70C '7.4.0':66C '7.4.8':68C '7.6.0':62C '7.6.6':64C '8.0.0':58C '8.0.1':60C 'allow':74C 'arbitrari':88C 'attack':77C 'authent':53C 'craft':92C 'delet':84C 'escal':79C 'fortimail':57C,61C,65C,69C 'fortinet':56C 'improp':52C 'mailbox':89C 'may':73C 'messag':86C 'privileg':80C 'quarantin':85C,93C 'releas':82C,94C 'request':95C 'unauthent':76C 'version':72C 'via':90C 'vulner':54C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126160","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126160","severity":null,"published_at":"2026-11-11T22:17:13+00:00","modified_at":"2026-11-11T22:17:13+00:00","first_seen_at":"2026-11-11T22:29:28+00:00","fetched_at":"2026-11-11T22:29:28+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}