---
id: "CVE-2026-126160"
page: "https://infrastack.ai/live/CVE-2026-126160"
kind: "vulnerability"
aliases: ["CVE-2026-126160"]
title: "Fortinet FortiMail: unauthenticated users can release or delete quarantined mail"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["email-security", "fortimail", "fortinet", "vendor"]
not_affected_if: ["unaffected-version"]
published_at: "2026-11-11T22:17:13+00:00"
first_seen_at: "2026-11-11T22:29:28+00:00"
updated_at: "2026-11-11T22:31:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126160", "first_seen_at": "2026-11-11T22:29:28+00:00"}]
exploit_sources: []
---

# Fortinet FortiMail: unauthenticated users can release or delete quarantined mail

Link for people: https://infrastack.ai/live/CVE-2026-126160 (this .md is for agents)

A missing authentication check in FortiMail lets an unauthenticated attacker send crafted quarantine requests. The attacker can escalate privileges and release or delete quarantined messages for any mailbox.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the FortiMail firmware version under the system dashboard against the affected ranges: `8.0.0` through `8.0.1`, `7.6.0` through `7.6.6`, `7.4.0` through `7.4.8`, and all `7.2` versions.

## Fix

- Move FortiMail 8.0 to a fixed release (the sources do not name the fixed version).
- Move FortiMail 7.6, 7.4 and 7.2 to a fixed release (the sources do not name the fixed versions).

## Timeline

- 2026-11-11T22:29:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126160

## From the sources

A improper authentication vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to escalate privileges and release or delete quarantined messages for arbitrary mailboxes via a crafted quarantine release requests.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_