Critical severity9.1NVD Advisory· Published Nov 11, 2026

CVE-2026-126156

Description

A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to take over an arbitrary IBE recipient account via crafted HTTP requests.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Fortinet/Fortimailllm-fuzzy
Range: 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, 7.2 all versions

Patches

Vulnerability mechanics

References

fortiguard.fortinet.com/psirt/FG-IR-26-208nvd

News mentions

Authorization bypass through user-controlled key
Fortinet PSIRT · Nov 10, 2026

cvss	0.591
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000