FortiMail weak password recovery allows unauthenticated account takeover (CVE-2026-126150)

What happened

Fortinet FortiMail contains a weak password recovery mechanism for forgotten passwords (CWE-640) in IBE webmail accounts. An unauthenticated attacker who can reach the webmail interface over the network can send specially crafted HTTP requests to reset the password of an arbitrary IBE user and take over the account. No credentials or user interaction are required.

The CVSS 3.1 score is 9.1, with high impact on confidentiality and integrity and no impact on availability. The CVE record does not report active exploitation or public disclosure, and the vulnerability is not listed in CISA's KEV catalogue.

Who is affected

The CVE record lists FortiMail 8.0.0, 7.6.0 through 7.6.5, 7.4.0 through 7.4.7, and 7.2.0 through 7.2.9. The vulnerable component is the IBE webmail forgotten-password recovery. Organisations running one of these versions with IBE webmail enabled or reachable should treat this as directly relevant.

What to do now

1. Determine exposure: locate FortiMail systems in the affected version ranges and confirm whether IBE webmail is enabled and reachable, especially from the internet.
2. Restrict access to the FortiMail IBE webmail interface to trusted networks or authenticated paths such as VPN or SSO; remove direct internet exposure where possible.
3. Review IBE webmail password reset and login activity for unexpected resets or account changes.
4. Monitor Fortinet's PSIRT advisory for this CVE. No fixed version or vendor workaround is listed in the CVE record yet.

How to detect it

The CVE record does not publish specific indicators of compromise. Because the flaw is in the password recovery flow, review IBE webmail password reset and login events for resets the account owner did not request, logins from unexpected locations shortly after a reset, and changes to recovery details.

Beyond the patch

This is exposure and supplier-patch-cycle risk in one: a critical password-reset flaw on FortiMail's IBE webmail is reachable over the network without credentials, and no fix is listed, so the exposure window is open-ended. Our Virtual CISO Services (vCISO) can help identify and reduce internet-facing FortiMail interfaces before an advisory like this arrives, and Supply Chain Defense & Third-Party Risk tracks vendors' patch cycles so you know what unpatched software you are carrying and for how long.