FortiMail improper authentication allows unauthenticated access to other users' secure email accounts (CVE-2026-126157)

What happened

An unauthenticated attacker can send crafted HTTP requests to a vulnerable FortiMail deployment and gain access to other users' secure email accounts. The flaw is reachable over the network, requires no privileges and needs no user interaction. The CVSS v3.1 vector rates it as critical with high impact to confidentiality and integrity.

Fortinet has not stated that this vulnerability is being exploited or has been publicly disclosed. It is not listed in CISA's KEV catalogue at the time of writing.

Who is affected

The affected versions of FortiMail are 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, 7.2.0 through 7.2.9, and 7.0.0 through 7.0.9. FortiMail is typically deployed as an email security gateway in front of mail servers, so these devices often sit on the network path for external email. No fixed release is listed yet.

What to do now

1. Confirm whether you run any of the affected FortiMail versions listed above.
2. Until Fortinet publishes a fixed version, restrict network access to FortiMail's HTTP-based interface to trusted networks and users.
3. Monitor secure email accounts for unexpected access, mailbox rule changes or forwarding changes.
4. Check Fortinet's advisory for updates and apply a fixed release when one is published.

How to detect it

Inventory FortiMail deployments and confirm versions against the affected list. Monitor access logs for secure email accounts showing unexpected source addresses, times, or changes to account settings. No specific indicators of compromise are provided in the available advisory information.

Beyond the patch

Because this flaw is reachable over the network without credentials, exposure matters as much as the missing patch. Virtual CISO Services (vCISO) can map exposed FortiMail interfaces, and Implementation & Assessment Services tests for authentication weaknesses such as CWE-287 before they become advisories. With no fixed release listed yet, tracking Fortinet's patch cadence is a third-party risk task, which Supply Chain Defense & Third-Party Risk addresses.