CVE-2026-126150 A weak password recovery mechanism for forgotten password vulnerability in Fortinet FortiMail 8.0.0, FortiMail 7.6.0 through 7.6.5, FortiMail 7.4.0 through 7.4.7, FortiMail 7.2.0 through 7.2.9 may all...
CriticalCVSS 9.1
- Published
- Updated
- Exploit status
- No public exploit known
Description
A weak password recovery mechanism for forgotten password vulnerability in Fortinet FortiMail 8.0.0, FortiMail 7.6.0 through 7.6.5, FortiMail 7.4.0 through 7.4.7, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to reset the password of an arbitrary IBE webmail user and take over their account via specially crafted HTTP requests.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fortinet fortimail | = 8.0.0 | No fix listed |
| fortinet fortimail | >= 7.6.0, <= 7.6.5 | No fix listed |
| fortinet fortimail | >= 7.4.0, <= 7.4.7 | No fix listed |
| fortinet fortimail | >= 7.2.0, <= 7.2.9 | No fix listed |