CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Fortinet FortiMail IBE webmail password reset and account takeover (9.1); 7.2 awaits 7.2.10

cve · CVE-2026-126150 single-source

Coverage
1
first 2026-10-23 → last 2026-11-12
Latest activity
2026-11-12
Fortinet advisories: FortiAnalyzer and FortiManager 8.0 have no fix for a 9.8 JSON API flaw; FortiMail RCE…
Peak priority
high
1 high
Targets
·
no sector or region stated
Sources cited
23
4 hosts

Action items (2)

Do-now tasks recorded on the entries about CVE-2026-126150, newest first. Check the date before acting on an older one.

  • Upgrade every FortiMail to 8.0.2, 7.6.7 or 7.4.9 (a 7.2 unit moves to a fixed release; 7.2.10 for CVE-2026-126150 is not released), every FortiAuthenticator to 8.0.4 or 6.6.11, every FortiOS to 8.0.2, 7.6.8, 7.4.13 or 7.2.14 (a 7.0 unit migrates), and every FortiManager and FortiAnalyzer on 7.6 or 7.4 to 7.6.8 or 7.4.12 (7.2 and 7.0 migrate), internet-facing units and FortiMail first, because the advisories describe unauthenticated code execution and account takeover and Fortinet warns that patch differences show attackers where the weakness sits; keep the FGFM and oftp ports and every administrative interface off untrusted networks.
    2026-10-23CVE-2026-126147 +18
  • On every FortiAnalyzer and FortiManager (Cloud variants included) on 8.0.0 through 8.0.2, set rpc-permit none on every administrator profile that has the JSON API enabled until Fortinet releases 8.0.3, because no 8.0 build fixes the unauthenticated 9.8 flaw CVE-2026-126170 and 8.0.2 is affected.
    2026-10-23CVE-2026-126147 +18

Defender insights

What each entry about CVE-2026-126150 tells a defender to do, newest first.

2026-10-23HIGHFortinet advisories: FortiAnalyzer and FortiManager 8.0 have no fix for a 9.8 JSON API flaw; FortiMail RCE rows too

Exposure · detection

Story timeline

  1. 2026-10-23Fortinet coordinated security hardening release: the advisories published on 2026-11-10 carry unauthenticated FortiMail, FortiAnalyzer, FortiManager, FortiOS and FortiAuthenticator flaws rated CVSS up to 9.8; FortiAnalyzer and FortiManager 8.0 have no fixed build for the JSON API flaw, FortiOS 7.0 and FortiMail 7.2 are left out of the October fixes
    trending-vulnerabilitiesFortinet advisories: FortiAnalyzer and FortiManager 8.0 have no fix for a 9.8 JSON API flaw; FortiMail RCE rows too

Hunting pivots

Affected products
Fortinet FortiAnalyzerFortinet FortiAuthenticatorFortinet FortiMailFortinet FortiManagerFortinet FortiOS
Tags
auth-bypasspatch-availablepre-authrcevulnerabilities
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.1 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-23/fortinet-hardening-release-fortios-fortimanager-fortimail · ATT&CK page ↗

Entries about Fortinet FortiMail IBE webmail password reset and account takeover (9.1); 7.2 awaits 7.2.10 (1)

2026-10-23 · view entry permalink →

HIGHCVE-2026-126147 +18updatedNATOA2

Fortinet coordinated security hardening release: the advisories published on 2026-11-10 carry unauthenticated FortiMail, FortiAnalyzer, FortiManager, FortiOS and FortiAuthenticator flaws rated CVSS up to 9.8; FortiAnalyzer and FortiManager 8.0 have no fixed build for the JSON API flaw, FortiOS 7.0 and FortiMail 7.2 are left out of the October fixes

Fortinet announced on 2026-10-21 coordinated security updates for FortiOS, FortiManager and FortiAnalyzer, released on 2026-10-22, and urged customers to treat them as a priority change because AI tools can help adversaries diff patches and build exploits within hours or days (Fortinet, 2026-10-21). The advisories withheld until Patch Tuesday were published on 2026-11-10; none of the 2026-11-10 advisories states exploitation, and NCSC.ch listed the status as unknown (NCSC.ch, 2026-10-22).

The critical rows (CVSS 9.0 or higher) by product. FortiMail: unauthenticated path traversal and command injection that may give code or command execution (CVE-2026-126147 and CVE-2026-126148, 9.8) (Fortinet PSIRT, 2026-11-10; Fortinet PSIRT, 2026-11-10), two SQL injections (CVE-2026-126164 and CVE-2026-126263, 9.4; the second is authenticated in its page summary and unauthenticated in its metadata) (Fortinet PSIRT, 2026-11-10; Fortinet PSIRT, 2026-11-10) and three IBE webmail takeover or access flaws (CVE-2026-126156, CVE-2026-126150 and CVE-2026-126155, 9.1) (Fortinet PSIRT, 2026-11-10; Fortinet PSIRT, 2026-11-10; Fortinet PSIRT, 2026-11-10) and an unauthenticated access flaw in other users' secure email accounts (CVE-2026-126157, 9.1) (Fortinet PSIRT, 2026-11-10). FortiAnalyzer and FortiManager: an unauthenticated GUI flaw that may allow code or command execution only when the JSON API is enabled, which is off by default (CVE-2026-126170, 9.8) (Fortinet PSIRT, 2026-11-10), oftp port SQL injection and SSRF (CVE-2026-126262, 9.3; CVE-2026-126260, 9.0) (Fortinet PSIRT, 2026-11-10; Fortinet PSIRT, 2026-11-10), an administrator's access to other VDOMs (CVE-2026-126229, 9.1) (Fortinet PSIRT, 2026-11-10) and FGFM code execution (CVE-2026-126261, 9.0) (Fortinet PSIRT, 2026-11-10). FortiOS: the OSPF daemon (CVE-2026-126253, 9.3), HA FGSP command execution (CVE-2026-126259, 9.0) and iBGP (CVE-2026-126254, 9.6) (Fortinet PSIRT, 2026-11-10; Fortinet PSIRT, 2026-11-10; Fortinet PSIRT, 2026-11-10). FortiAuthenticator: two authentication bypasses (CVE-2026-126257, 9.0; CVE-2026-126251, 9.1) (Fortinet PSIRT, 2026-11-10; Fortinet PSIRT, 2026-11-10). FortiClient: an origin-validation flaw that needs victim interaction (CVE-2026-121529, 9.1) (Fortinet PSIRT, 2026-11-10).

The October builds fix most rows: FortiOS 8.0.2, 7.6.8, 7.4.13 and 7.2.14; FortiManager and FortiAnalyzer 8.0.2, 7.6.8, 7.4.12 and 7.2.13; FortiMail 8.0.2, 7.6.7 and 7.4.9; FortiAuthenticator 8.0.4 and 6.6.11 (Fortinet, 2026-10-21). Not every row: no 8.0 build fixes CVE-2026-126170 until the upcoming 8.0.3, with rpc-permit none on admin profiles that have the JSON API enabled as the workaround (Fortinet PSIRT, 2026-11-10); FortiMail 7.2 awaits 7.2.10 for CVE-2026-126150 (Fortinet PSIRT, 2026-11-10); FortiAnalyzer and FortiManager 7.2 and 7.0 and FortiOS 7.0 must migrate (Fortinet PSIRT, 2026-11-10; Fortinet PSIRT, 2026-11-10; Fortinet PSIRT, 2026-11-10). The FortiMail builds also fix the exploited CVE-2026-104286 (Fortinet PSIRT, 2026-10-01).

We strongly urge every customer to plan and promptly complete these upgrades as soon as the releases are available, prioritizing internet-facing devices.

These releases include critical and high-severity fixes.

public advisories will be made available at the next Patch Tuesday on November 10

Fortinet (CISO Collective blog) 2026-10-21

may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests

Fortinet PSIRT (FG-IR-26-199, CVE-2026-126147) 2026-11-10

may allow an unauthenticated attacker that can reach the FGFM port to execute code or commands via crafted FGFM packets

Fortinet PSIRT (FG-IR-26-275, CVE-2026-126261) 2026-11-10

to take over an arbitrary IBE recipient account via crafted HTTP requests

Fortinet PSIRT (FG-IR-26-208, CVE-2026-126156) 2026-11-10

may allow an unauthenticated attacker to bypass credential validation in certain circumstances outside of the attacker's control and gain unauthorized access

Fortinet PSIRT (FG-IR-26-271, CVE-2026-126257) 2026-11-10

The vulnerability exists only when the JSON API is enabled (Disabled by default)

may allow an unauthenticated attacker to execute unauthorized code or commands via a specially crafted HTTP request

Fortinet PSIRT (FG-IR-26-219, CVE-2026-126170) 2026-11-10
Updaterun 2026-11-11T0256Z-inteltitleheadlinesummarytagscvessourcesevidencesourcing_noteactionsbody

Fortinet published the advisories it had withheld from the October hardening release on 2026-11-10. They name unauthenticated FortiMail flaws that may allow code or command execution through crafted requests (CVE-2026-126147, CVSS 9.8) (Fortinet PSIRT, 2026-11-10) and through HA join-request packets (CVE-2026-126148, 9.8) (Fortinet PSIRT, 2026-11-10), an unauthenticated SQL injection (CVE-2026-126164, 9.4) that Fortinet remediated in FortiMail Cloud on 2026-10-05 (Fortinet PSIRT, 2026-11-10), and two IBE webmail flaws that let an attacker take over an IBE recipient account (CVE-2026-126156, 9.1) (Fortinet PSIRT, 2026-11-10) or obtain an authenticated session as one (CVE-2026-126155, 9.1) (Fortinet PSIRT, 2026-11-10). Two FortiAuthenticator flaws, a hard-coded-password bypass (CVE-2026-126257, 9.0) (Fortinet PSIRT, 2026-11-10) and an incorrect-authorization authentication bypass (CVE-2026-126251, 9.1) (Fortinet PSIRT, 2026-11-10), a FortiOS and FortiSASE OSPF flaw that lets an unauthenticated attacker on the adjacent network broadcast link-state advertisements (CVE-2026-126253, 9.3) (Fortinet PSIRT, 2026-11-10) and unauthenticated code execution through the FortiManager FGFM port (CVE-2026-126261, 9.0) (Fortinet PSIRT, 2026-11-10) are the other rows that page named. The October builds fix most of them but not on every branch (FortiMail 7.2 and FortiOS 7.0 are told to migrate for some rows, as the update below sets out), FG-IR-26-275 lists lower minimum FortiManager builds (8.0.1, 7.6.8, 7.4.6 and 7.2.9) for the FGFM flaw, and none of the 2026-11-10 advisories states exploitation.

Updaterun 2026-11-12T0255Z-inteltitleheadlinesummarycvessourcesevidencesourcing_noteactionsbody

The advisory pages carry ten more critical rows (CVSS 9.0 or higher), shown above, and the October builds do not fix every row: FortiAnalyzer and FortiManager 8.0.0 through 8.0.2 have no fixed build for CVE-2026-126170 until the upcoming 8.0.3 (Fortinet PSIRT, 2026-11-10), FortiMail 7.2 awaits 7.2.10 for CVE-2026-126150 (Fortinet PSIRT, 2026-11-10), FortiAnalyzer and FortiManager 7.2 and 7.0 must migrate for CVE-2026-126229 (Fortinet PSIRT, 2026-11-10), and FortiOS 7.0 must migrate for CVE-2026-126253 and CVE-2026-126259 (Fortinet PSIRT, 2026-11-10) (Fortinet PSIRT, 2026-11-10).

Builds on: Unit 42: a memory-resident FortiGate implant rides an exploited FortiOS flaw that has no fix on… · Fortinet now names fixed FortiMail builds for an unauthenticated file-write flaw it confirmed…

vulnerability23 Oct 03:38Zsingle-sourceOpen finding →
Sources: Fortinet (CISO Collective blog) · NCSC.ch Security Hub (advisory 13092) · heise online · Fortinet PSIRT (FG-IR-26-175) · Fortinet PSIRT (FG-IR-26-199, CVE-2026-126147) · Fortinet PSIRT (FG-IR-26-200, CVE-2026-126148) · Fortinet PSIRT (FG-IR-26-216, CVE-2026-126164) · Fortinet PSIRT (FG-IR-26-208, CVE-2026-126156) · Fortinet PSIRT (FG-IR-26-207, CVE-2026-126155) · Fortinet PSIRT (FG-IR-26-271, CVE-2026-126257) · Fortinet PSIRT (FG-IR-26-265, CVE-2026-126251) · Fortinet PSIRT (FG-IR-26-267, CVE-2026-126253) · Fortinet PSIRT (FG-IR-26-275, CVE-2026-126261) · Fortinet PSIRT (FG-IR-26-219, CVE-2026-126170) · Fortinet PSIRT (FG-IR-26-274, CVE-2026-126260) · Fortinet PSIRT (FG-IR-26-276, CVE-2026-126262) · Fortinet PSIRT (FG-IR-26-273, CVE-2026-126259) · Fortinet PSIRT (FG-IR-26-268, CVE-2026-126254) · Fortinet PSIRT (FG-IR-26-277, CVE-2026-126263) · Fortinet PSIRT (FG-IR-26-209, CVE-2026-126157) · Fortinet PSIRT (FG-IR-26-202, CVE-2026-126150) · Fortinet PSIRT (FG-IR-26-244, CVE-2026-126229) · Fortinet PSIRT (FG-IR-26-194, CVE-2026-121529)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • fortiguard.fortinet.com20 (87%)
  • fortinet.com1 (4%)
  • heise.de1 (4%)
  • security-hub.ncsc.admin.ch1 (4%)

External references

NVD · cve.org · CISA KEV

All cited sources (23)