CVE-2026-126160

high

Description

A improper authentication vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to escalate privileges and release or delete quarantined messages for arbitrary mailboxes via a crafted quarantine release requests.

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-212

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-123833

Details

Source: Mitre, NVD

Published: 2026-11-11

Updated: 2026-11-11

Risk Information

CVSS v2

Base Score: 8.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:P

Severity: High

CVSS v3

Base Score: 8.2

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Severity: High

EPSS

EPSS: 0.00473