CVE-2026-126147CVSS 9.8Path traversal
An unauthenticated attacker can use crafted requests to execute code or commands.
FortiMail fixes five critical flaws in request handling, HA and encrypted mail
Fortinet’s November batch fixes three unauthenticated code execution paths and two identity-based encryption account or session takeovers. Update self-managed FortiMail. Fortinet says it fixed these five issues in FortiMail Cloud on October 5.
- Disclosed
- Nov 10, 2026
- Public disclosure date
- Severity
- CVSS 9.8 × 2
- 5 CVEs tracked here
- Splash zone
- Affected FortiMail builds with reachable request handlers or HA services. The HA join bug applies to 8.0 and 7.6 only.
- Fortinet · FortiMail · RCE
- In the wild
- Unknown
What happened
The five critical FortiMail advisories cover different paths. The path traversal and SQL injection allow code or command execution through crafted requests. The HA issue requires access to send crafted cluster join requests. The two IBE issues use HTTP and affect recipient account or webmail session handling.
All five cover 8.0.0–8.0.1 and 7.6.0–7.6.6. Four also cover 7.4.0–7.4.8 and all 7.2 builds. CVE-2026-126148 is the HA exception and does not affect those older lines. The vendor advises migration from 7.2 to a fixed release for the other four. Fortinet’s separate FortiMail Cloud statement applies to the five issues covered here. Check your deployment type before acting.
The reviewed sources do not establish exploitation or a victim count. This entry covers the five critical FortiMail advisories from this batch. FortiAuthenticator is covered in a separate entry.
What’s in the bowl
CVE-2026-126148CVSS 9.8HA join command injection
Crafted high availability join request packets can execute code or commands without a login. The advisory applies only to the 8.0 and 7.6 branches.
CVE-2026-126164CVSS 9.4SQL injection
An unauthenticated attacker can use crafted requests to execute unauthorized code or commands.
CVE-2026-126155CVSS 9.1IBE session takeover
A crafted HTTP request can grant an unauthenticated attacker an authenticated identity-based encryption webmail session to read or send encrypted mail as a recipient.
CVE-2026-126156CVSS 9.1IBE account takeover
A crafted HTTP request can let an unauthenticated attacker take over an arbitrary identity-based encryption recipient account.
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| FortiMail 8.0 | 8.0.2 | |
| FortiMail 7.6 | 7.6.7 | |
| FortiMail 7.4 | 7.4.9 | |
| FortiMail 7.2 | No fix | Migrate to a fixed release |
Crime-scene timeline
Oct 5, 2026
Fortinet reports patching its cloud service
The November advisories retrospectively date the FortiMail Cloud remediation to October 5.
Nov 10, 2026
Fortinet publishes the critical FortiMail advisories
The advisories list affected builds, fixes and the separate HA and encrypted mail prerequisites.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Fortinet CSAF FG-IR-26-199PrimaryVendor scope, score and remediation for CVE-2026-126147.
- Fortinet CSAF FG-IR-26-200PrimaryVendor scope, score and remediation for CVE-2026-126148.
- Fortinet CSAF FG-IR-26-216PrimaryVendor scope, score and remediation for CVE-2026-126164.
- Fortinet CSAF FG-IR-26-207PrimaryVendor scope, score and remediation for CVE-2026-126155.
- Fortinet CSAF FG-IR-26-208PrimaryVendor scope, score and remediation for CVE-2026-126156.
- FortiMail maintenance guidePrimaryFirmware menu and configuration backup instructions.