NCSC-2026-0487
Vulnerability from csaf_ncscnl - Published: 2026-11-12 08:54 - Updated: 2026-11-12 08:54Summary
Kwetsbaarheden verholpen in Fortinet FortiMail
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: Fortinet heeft meerdere kwetsbaarheden verholpen in FortiMail.
Interpretaties: De kwetsbaarheden in FortiMail betreffen onder andere OS command injection, path traversal, SQL-injectie, authenticatie- en autorisatieproblemen, argument injection, XML-injectie, en resource consumptie. Sommige kwetsbaarheden kunnen door ongeauthenticeerde aanvallers worden misbruikt, terwijl andere authenticatie vereisen. Exploitatie kan leiden tot het uitvoeren van ongeautoriseerde commando's op root-niveau, het omzeilen van authenticatie en autorisatie, het resetten van wachtwoorden van webmailgebruikers, het lezen en verzenden van versleutelde e-mails namens andere gebruikers, het verwijderen van gebruikers in multi-tenant omgevingen, en het veroorzaken van denial-of-service door crashes of resource uitputting. De kwetsbaarheden beïnvloeden verschillende versies van FortiMail, met name versies tussen 7.2 en 8.0.2, en hebben impact op kernfunctionaliteiten zoals mailverwerking, webmailinterfaces, administratieve interfaces, en integratie met FortiAuthenticator.
Oplossingen: Fortinet heeft updates uitgebracht om de kwetsbaarheden in FortiMail te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans: medium
Schade: high
CWE-22: Improper Limitation of a Pathname to a Restricted Directory
CWE-77: Improper Neutralization of Special Elements used in a Command
CWE-78: Improper Neutralization of Special Elements used in an OS Command
CWE-88: Improper Neutralization of Argument Delimiters in a Command
CWE-89: Improper Neutralization of Special Elements used in an SQL Command
CWE-91: XML Injection
CWE-134: Use of Externally-Controlled Format String
CWE-190: Integer Overflow or Wraparound
CWE-303: Incorrect Implementation of Authentication Algorithm
CWE-639: Authorization Bypass Through User-Controlled Key
CWE-640: Weak Password Recovery Mechanism for Forgotten Password
CWE-787: Out-of-bounds Write
CWE-789: Memory Allocation with Excessive Size Value
CWE-863: Incorrect Authorization
An OS Command Injection vulnerability in multiple versions of FortiMail, FortiRecorder, and FortiVoice allows authenticated attackers to execute unauthorized commands via specially crafted HTTP requests.
CWE-78 - Improper Neutralization of Special Elements used in an OS CommandAffected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Fortinet / FortiMail
|
vers:unknown/* |
Fortinet FortiMail versions 7.2 through 8.0.1 contain an OS Command Injection vulnerability (CWE-78) that allows an authenticated administrator with system-time read-write access to execute unauthorized root-level commands.
CWE-78 - Improper Neutralization of Special Elements used in an OS CommandAffected products
Known affected
1 product, the same list as for
CVE-2026-126144
An OS Command Injection vulnerability in Fortinet FortiMail (7.2.0 to 8.0.1) and FortiRecorder (7.0.0 to 7.6.0) allows an authenticated privileged attacker to execute unauthorized commands via a specially crafted archive account configuration.
CWE-78 - Improper Neutralization of Special Elements used in an OS CommandAffected products
Known affected
1 product, the same list as for
CVE-2026-126144
A path traversal vulnerability in multiple versions of Fortinet FortiMail allows unauthenticated attackers to execute unauthorized code or commands via crafted requests.
9.8 (Critical)
Affected products
Known affected
1 product, the same list as for
CVE-2026-126144
Fortinet FortiMail versions 7.6.0 to 7.6.6 and 8.0.0 to 8.0.1 contain an OS command injection vulnerability via crafted HA join-request packets, allowing unauthenticated attackers to execute unauthorized commands.
9.8 (Critical)
Affected products
Known affected
1 product, the same list as for
CVE-2026-126144
An integer overflow vulnerability in multiple versions of Fortinet FortiMail may allow a remote unauthenticated attacker to crash the daemon, potentially disrupting mail services.
7.5 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-126144
A vulnerability in Fortinet FortiMail versions 7.2.0 to 8.0.0 allows unauthenticated attackers to reset any IBE webmail user's password and take over their account via crafted HTTP requests exploiting a weak password recovery mechanism.
9.1 (Critical)
Affected products
Known affected
1 product, the same list as for
CVE-2026-126144
Multiple versions of Fortinet FortiMail contain an authentication algorithm flaw that allows unauthenticated remote attackers to elevate privileges and compromise accounts via crafted requests.
CWE-303 - Incorrect Implementation of Authentication AlgorithmAffected products
Known affected
1 product, the same list as for
CVE-2026-126144
An authorization bypass vulnerability in Fortinet FortiMail allows authenticated remote attackers to delete arbitrary directories as root or access and delete other users' calendar and mailbox data across tenant domains via crafted HTTP requests.
CWE-639 - Authorization Bypass Through User-Controlled KeyAffected products
Known affected
1 product, the same list as for
CVE-2026-126144
A path traversal vulnerability in multiple versions of Fortinet FortiMail allows unauthenticated attackers to execute unauthorized commands via crafted requests.
CWE-22 - Improper Limitation of a Pathname to a Restricted DirectoryAffected products
Known affected
1 product, the same list as for
CVE-2026-126144
Multiple versions of Fortinet FortiMail contain an out-of-bounds write vulnerability that allows remote unauthenticated attackers to cause denial of service via specially crafted HTTP requests.
7.5 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-126144
Fortinet FortiMail versions 7.2 through 8.0.1 contain an incorrect authorization vulnerability allowing unauthenticated remote attackers to access any recipient's authenticated IBE webmail session and read or send encrypted mail via crafted HTTP requests.
9.1 (Critical)
Affected products
Known affected
1 product, the same list as for
CVE-2026-126144
An authorization bypass vulnerability in Fortinet FortiMail allows unauthenticated remote attackers to take over arbitrary IBE recipient accounts via crafted HTTP requests.
9.1 (Critical)
Affected products
Known affected
1 product, the same list as for
CVE-2026-126144
An improper authentication vulnerability in multiple versions of Fortinet FortiMail allows unauthenticated attackers to access other users' secure email accounts via crafted HTTP requests.
9.1 (Critical)
Affected products
Known affected
1 product, the same list as for
CVE-2026-126144
Fortinet FortiMail versions 8.0.0 through 8.0.1 contain an OS Command Injection vulnerability (CWE-78) that allows an authenticated administrator to execute unauthorized root-level commands via specially crafted HTTP requests.
CWE-78 - Improper Neutralization of Special Elements used in an OS CommandAffected products
Known affected
1 product, the same list as for
CVE-2026-126144
An authorization bypass vulnerability in Fortinet FortiMail allows unauthenticated attackers to release or delete quarantined messages for arbitrary mailboxes via crafted quarantine release requests.
CWE-639 - Authorization Bypass Through User-Controlled KeyAffected products
Known affected
1 product, the same list as for
CVE-2026-126144
Fortinet FortiMail versions 7.2 through 8.0.1 contain an improper authentication vulnerability allowing unauthenticated attackers to escalate privileges and manipulate quarantined messages via crafted quarantine release requests.
Affected products
Known affected
1 product, the same list as for
CVE-2026-126144
An uncontrolled resource consumption vulnerability in Fortinet FortiMail versions 7.4.0 to 7.4.6, 7.6.0 to 7.6.6, and 8.0.0 to 8.0.1 allows remote unauthenticated attackers to cause denial of service via repeated unauthenticated POST requests.
7.5 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-126144
A vulnerability in Fortinet FortiMail versions 7.6.0 to 7.6.6 and 8.0.0 to 8.0.1 allows remote unauthenticated attackers to execute unauthorized code via a specially crafted blind XPath XML injection request.
8.7 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-126144
A remote unauthenticated attacker can execute unauthorized code or commands on Fortinet FortiMail versions 8.0.0 to 8.0.1 via a specially crafted SMTP command.
CWE-134 - Use of Externally-Controlled Format StringAffected products
Known affected
1 product, the same list as for
CVE-2026-126144
Fortinet FortiMail versions 7.2 through 8.0.1 contain an SQL injection vulnerability that allows unauthenticated attackers to execute unauthorized code or commands via crafted requests.
9.4 (Critical)
Affected products
Known affected
1 product, the same list as for
CVE-2026-126144
A vulnerability in Fortinet FortiMail versions 7.2 through 8.0.1 allows remote unauthenticated attackers to cause denial of service via a specially crafted SMTP attachment triggering excessive memory allocation.
CWE-789 - Memory Allocation with Excessive Size ValueAffected products
Known affected
1 product, the same list as for
CVE-2026-126144
Fortinet FortiMail versions 7.2 through 8.0.2 contain an argument injection vulnerability (CWE-88) that allows authenticated admin users to delete users from other tenant domains on paired FortiAuthenticator devices, execute arbitrary root code or CLI commands, and read or write files via crafted HTTP requests to the admin interface.
CWE-88 - Improper Neutralization of Argument Delimiters in a CommandAffected products
Known affected
1 product, the same list as for
CVE-2026-126144
An argument injection vulnerability (CWE-88) in Fortinet FortiMail allows authenticated admin users to delete tenant users on paired FortiAuthenticator devices, execute arbitrary root code or CLI commands, and read or write files via crafted HTTP requests to the admin interface.
CWE-77 - Improper Neutralization of Special Elements used in a CommandAffected products
Known affected
1 product, the same list as for
CVE-2026-126144
Fortinet FortiMail versions 7.2 through 8.0.2 contain an argument injection vulnerability (CWE-88) that allows authenticated admin users to delete users from other tenant domains on paired FortiAuthenticator devices, execute arbitrary root code or CLI commands, and read or write files via crafted HTTP requests to the admin interface.
CWE-88 - Improper Neutralization of Argument Delimiters in a CommandAffected products
Known affected
1 product, the same list as for
CVE-2026-126144
Fortinet FortiMail versions 7.2 through 8.0.2 contain an argument injection vulnerability (CWE-88) that allows authenticated admin users to delete users from other tenant domains on paired FortiAuthenticator devices, execute arbitrary root code or CLI commands, and read or write files via crafted HTTP requests to the admin interface.
CWE-88 - Improper Neutralization of Argument Delimiters in a CommandAffected products
Known affected
1 product, the same list as for
CVE-2026-126144
An SQL injection vulnerability in Fortinet FortiMail versions 7.4.0 to 8.0.1 allows authenticated attackers to execute unauthorized code or commands via specially crafted requests.
9.8 (Critical)
Affected products
Known affected
1 product, the same list as for
CVE-2026-126144
References
51 references
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "Fortinet heeft meerdere kwetsbaarheden verholpen in FortiMail.",
"title": "Feiten"
},
{
"category": "description",
"text": "De kwetsbaarheden in FortiMail betreffen onder andere OS command injection, path traversal, SQL-injectie, authenticatie- en autorisatieproblemen, argument injection, XML-injectie, en resource consumptie. Sommige kwetsbaarheden kunnen door ongeauthenticeerde aanvallers worden misbruikt, terwijl andere authenticatie vereisen. Exploitatie kan leiden tot het uitvoeren van ongeautoriseerde commando\u0027s op root-niveau, het omzeilen van authenticatie en autorisatie, het resetten van wachtwoorden van webmailgebruikers, het lezen en verzenden van versleutelde e-mails namens andere gebruikers, het verwijderen van gebruikers in multi-tenant omgevingen, en het veroorzaken van denial-of-service door crashes of resource uitputting. De kwetsbaarheden be\u00efnvloeden verschillende versies van FortiMail, met name versies tussen 7.2 en 8.0.2, en hebben impact op kernfunctionaliteiten zoals mailverwerking, webmailinterfaces, administratieve interfaces, en integratie met FortiAuthenticator.",
"title": "Interpretaties"
},
{
"category": "description",
"text": "Fortinet heeft updates uitgebracht om de kwetsbaarheden in FortiMail te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
"title": "Oplossingen"
},
{
"category": "general",
"text": "medium",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "Improper Limitation of a Pathname to a Restricted Directory",
"title": "CWE-22"
},
{
"category": "general",
"text": "Improper Neutralization of Special Elements used in a Command",
"title": "CWE-77"
},
{
"category": "general",
"text": "Improper Neutralization of Special Elements used in an OS Command",
"title": "CWE-78"
},
{
"category": "general",
"text": "Improper Neutralization of Argument Delimiters in a Command",
"title": "CWE-88"
},
{
"category": "general",
"text": "Improper Neutralization of Special Elements used in an SQL Command",
"title": "CWE-89"
},
{
"category": "general",
"text": "XML Injection",
"title": "CWE-91"
},
{
"category": "general",
"text": "Use of Externally-Controlled Format String",
"title": "CWE-134"
},
{
"category": "general",
"text": "Integer Overflow or Wraparound",
"title": "CWE-190"
},
{
"category": "general",
"text": "Incorrect Implementation of Authentication Algorithm",
"title": "CWE-303"
},
{
"category": "general",
"text": "Authorization Bypass Through User-Controlled Key",
"title": "CWE-639"
},
{
"category": "general",
"text": "Weak Password Recovery Mechanism for Forgotten Password",
"title": "CWE-640"
},
{
"category": "general",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "general",
"text": "Memory Allocation with Excessive Size Value",
"title": "CWE-789"
},
{
"category": "general",
"text": "Incorrect Authorization",
"title": "CWE-863"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Reference",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-196"
},
{
"category": "external",
"summary": "Reference",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-197"
},
{
"category": "external",
"summary": "Reference",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-198"
},
{
"category": "external",
"summary": "Reference",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-199"
},
{
"category": "external",
"summary": "Reference",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-200"
},
{
"category": "external",
"summary": "Reference",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-201"
},
{
"category": "external",
"summary": "Reference",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-202"
},
{
"category": "external",
"summary": "Reference",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-203"
},
{
"category": "external",
"summary": "Reference",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-204"
},
{
"category": "external",
"summary": "Reference",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-205"
},
{
"category": "external",
"summary": "Reference",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-206"
},
{
"category": "external",
"summary": "Reference",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-207"
},
{
"category": "external",
"summary": "Reference",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-208"
},
{
"category": "external",
"summary": "Reference",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-209"
},
{
"category": "external",
"summary": "Reference",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-210"
},
{
"category": "external",
"summary": "Reference",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-211"
},
{
"category": "external",
"summary": "Reference",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-212"
},
{
"category": "external",
"summary": "Reference",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-213"
},
{
"category": "external",
"summary": "Reference",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-214"
},
{
"category": "external",
"summary": "Reference",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-215"
},
{
"category": "external",
"summary": "Reference",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-216"
},
{
"category": "external",
"summary": "Reference",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-217"
},
{
"category": "external",
"summary": "Reference",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-218"
},
{
"category": "external",
"summary": "Reference",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-277"
}
],
"title": "Kwetsbaarheden verholpen in Fortinet FortiMail",
"tracking": {
"current_release_date": "2026-11-12T08:54:20.264598Z",
"generator": {
"date": "2025-08-04T16:30:00Z",
"engine": {
"name": "V.A.",
"version": "1.3"
}
},
"id": "NCSC-2026-0487",
"initial_release_date": "2026-11-12T08:54:20.264598Z",
"revision_history": [
{
"date": "2026-11-12T08:54:20.264598Z",
"number": "1.0.0",
"summary": "Initiele versie"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-1"
}
}
],
"category": "product_name",
"name": "FortiMail"
}
],
"category": "vendor",
"name": "Fortinet"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-126144",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Special Elements used in an OS Command",
"title": "CWE-78"
},
{
"category": "description",
"text": "An OS Command Injection vulnerability in multiple versions of FortiMail, FortiRecorder, and FortiVoice allows authenticated attackers to execute unauthorized commands via specially crafted HTTP requests.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-126144 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126144.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-126144"
},
{
"cve": "CVE-2026-126145",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Special Elements used in an OS Command",
"title": "CWE-78"
},
{
"category": "description",
"text": "Fortinet FortiMail versions 7.2 through 8.0.1 contain an OS Command Injection vulnerability (CWE-78) that allows an authenticated administrator with system-time read-write access to execute unauthorized root-level commands.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-126145 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126145.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-126145"
},
{
"cve": "CVE-2026-126146",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Special Elements used in an OS Command",
"title": "CWE-78"
},
{
"category": "description",
"text": "An OS Command Injection vulnerability in Fortinet FortiMail (7.2.0 to 8.0.1) and FortiRecorder (7.0.0 to 7.6.0) allows an authenticated privileged attacker to execute unauthorized commands via a specially crafted archive account configuration.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-126146 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126146.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-126146"
},
{
"cve": "CVE-2026-126147",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory"
},
"notes": [
{
"category": "other",
"text": "Improper Limitation of a Pathname to a Restricted Directory",
"title": "CWE-22"
},
{
"category": "description",
"text": "A path traversal vulnerability in multiple versions of Fortinet FortiMail allows unauthenticated attackers to execute unauthorized code or commands via crafted requests.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-126147 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126147.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:R",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-126147"
},
{
"cve": "CVE-2026-126148",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Special Elements used in an OS Command",
"title": "CWE-78"
},
{
"category": "description",
"text": "Fortinet FortiMail versions 7.6.0 to 7.6.6 and 8.0.0 to 8.0.1 contain an OS command injection vulnerability via crafted HA join-request packets, allowing unauthenticated attackers to execute unauthorized commands.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-126148 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126148.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:R",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-126148"
},
{
"cve": "CVE-2026-126149",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "other",
"text": "Integer Overflow or Wraparound",
"title": "CWE-190"
},
{
"category": "description",
"text": "An integer overflow vulnerability in multiple versions of Fortinet FortiMail may allow a remote unauthenticated attacker to crash the daemon, potentially disrupting mail services.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-126149 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126149.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-126149"
},
{
"cve": "CVE-2026-126150",
"cwe": {
"id": "CWE-640",
"name": "Weak Password Recovery Mechanism for Forgotten Password"
},
"notes": [
{
"category": "other",
"text": "Weak Password Recovery Mechanism for Forgotten Password",
"title": "CWE-640"
},
{
"category": "description",
"text": "A vulnerability in Fortinet FortiMail versions 7.2.0 to 8.0.0 allows unauthenticated attackers to reset any IBE webmail user\u0027s password and take over their account via crafted HTTP requests exploiting a weak password recovery mechanism.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-126150 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126150.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:R",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-126150"
},
{
"cve": "CVE-2026-126151",
"cwe": {
"id": "CWE-303",
"name": "Incorrect Implementation of Authentication Algorithm"
},
"notes": [
{
"category": "other",
"text": "Incorrect Implementation of Authentication Algorithm",
"title": "CWE-303"
},
{
"category": "description",
"text": "Multiple versions of Fortinet FortiMail contain an authentication algorithm flaw that allows unauthenticated remote attackers to elevate privileges and compromise accounts via crafted requests.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-126151 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126151.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:R",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-126151"
},
{
"cve": "CVE-2026-126152",
"cwe": {
"id": "CWE-639",
"name": "Authorization Bypass Through User-Controlled Key"
},
"notes": [
{
"category": "other",
"text": "Authorization Bypass Through User-Controlled Key",
"title": "CWE-639"
},
{
"category": "description",
"text": "An authorization bypass vulnerability in Fortinet FortiMail allows authenticated remote attackers to delete arbitrary directories as root or access and delete other users\u0027 calendar and mailbox data across tenant domains via crafted HTTP requests.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-126152 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126152.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:U/RL:U/RC:R",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-126152"
},
{
"cve": "CVE-2026-126153",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory"
},
"notes": [
{
"category": "other",
"text": "Improper Limitation of a Pathname to a Restricted Directory",
"title": "CWE-22"
},
{
"category": "description",
"text": "A path traversal vulnerability in multiple versions of Fortinet FortiMail allows unauthenticated attackers to execute unauthorized commands via crafted requests.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-126153 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126153.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-126153"
},
{
"cve": "CVE-2026-126154",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "description",
"text": "Multiple versions of Fortinet FortiMail contain an out-of-bounds write vulnerability that allows remote unauthenticated attackers to cause denial of service via specially crafted HTTP requests.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-126154 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126154.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-126154"
},
{
"cve": "CVE-2026-126155",
"cwe": {
"id": "CWE-863",
"name": "Incorrect Authorization"
},
"notes": [
{
"category": "other",
"text": "Incorrect Authorization",
"title": "CWE-863"
},
{
"category": "description",
"text": "Fortinet FortiMail versions 7.2 through 8.0.1 contain an incorrect authorization vulnerability allowing unauthenticated remote attackers to access any recipient\u0027s authenticated IBE webmail session and read or send encrypted mail via crafted HTTP requests.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-126155 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126155.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:R",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-126155"
},
{
"cve": "CVE-2026-126156",
"cwe": {
"id": "CWE-639",
"name": "Authorization Bypass Through User-Controlled Key"
},
"notes": [
{
"category": "other",
"text": "Authorization Bypass Through User-Controlled Key",
"title": "CWE-639"
},
{
"category": "description",
"text": "An authorization bypass vulnerability in Fortinet FortiMail allows unauthenticated remote attackers to take over arbitrary IBE recipient accounts via crafted HTTP requests.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-126156 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126156.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-126156"
},
{
"cve": "CVE-2026-126157",
"notes": [
{
"category": "description",
"text": "An improper authentication vulnerability in multiple versions of Fortinet FortiMail allows unauthenticated attackers to access other users\u0027 secure email accounts via crafted HTTP requests.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-126157 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126157.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-126157"
},
{
"cve": "CVE-2026-126158",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Special Elements used in an OS Command",
"title": "CWE-78"
},
{
"category": "description",
"text": "Fortinet FortiMail versions 8.0.0 through 8.0.1 contain an OS Command Injection vulnerability (CWE-78) that allows an authenticated administrator to execute unauthorized root-level commands via specially crafted HTTP requests.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-126158 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126158.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-126158"
},
{
"cve": "CVE-2026-126159",
"cwe": {
"id": "CWE-639",
"name": "Authorization Bypass Through User-Controlled Key"
},
"notes": [
{
"category": "other",
"text": "Authorization Bypass Through User-Controlled Key",
"title": "CWE-639"
},
{
"category": "description",
"text": "An authorization bypass vulnerability in Fortinet FortiMail allows unauthenticated attackers to release or delete quarantined messages for arbitrary mailboxes via crafted quarantine release requests.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-126159 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126159.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-126159"
},
{
"cve": "CVE-2026-126160",
"notes": [
{
"category": "description",
"text": "Fortinet FortiMail versions 7.2 through 8.0.1 contain an improper authentication vulnerability allowing unauthenticated attackers to escalate privileges and manipulate quarantined messages via crafted quarantine release requests.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-126160 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126160.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-126160"
},
{
"cve": "CVE-2026-126161",
"notes": [
{
"category": "description",
"text": "An uncontrolled resource consumption vulnerability in Fortinet FortiMail versions 7.4.0 to 7.4.6, 7.6.0 to 7.6.6, and 8.0.0 to 8.0.1 allows remote unauthenticated attackers to cause denial of service via repeated unauthenticated POST requests.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-126161 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126161.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-126161"
},
{
"cve": "CVE-2026-126162",
"cwe": {
"id": "CWE-91",
"name": "XML Injection"
},
"notes": [
{
"category": "other",
"text": "XML Injection",
"title": "CWE-91"
},
{
"category": "description",
"text": "A vulnerability in Fortinet FortiMail versions 7.6.0 to 7.6.6 and 8.0.0 to 8.0.1 allows remote unauthenticated attackers to execute unauthorized code via a specially crafted blind XPath XML injection request.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-126162 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126162.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-126162"
},
{
"cve": "CVE-2026-126163",
"cwe": {
"id": "CWE-134",
"name": "Use of Externally-Controlled Format String"
},
"notes": [
{
"category": "other",
"text": "Use of Externally-Controlled Format String",
"title": "CWE-134"
},
{
"category": "description",
"text": "A remote unauthenticated attacker can execute unauthorized code or commands on Fortinet FortiMail versions 8.0.0 to 8.0.1 via a specially crafted SMTP command.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-126163 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126163.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-126163"
},
{
"cve": "CVE-2026-126164",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Special Elements used in an SQL Command",
"title": "CWE-89"
},
{
"category": "description",
"text": "Fortinet FortiMail versions 7.2 through 8.0.1 contain an SQL injection vulnerability that allows unauthenticated attackers to execute unauthorized code or commands via crafted requests.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-126164 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126164.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-126164"
},
{
"cve": "CVE-2026-126165",
"cwe": {
"id": "CWE-789",
"name": "Memory Allocation with Excessive Size Value"
},
"notes": [
{
"category": "other",
"text": "Memory Allocation with Excessive Size Value",
"title": "CWE-789"
},
{
"category": "description",
"text": "A vulnerability in Fortinet FortiMail versions 7.2 through 8.0.1 allows remote unauthenticated attackers to cause denial of service via a specially crafted SMTP attachment triggering excessive memory allocation.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-126165 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126165.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-126165"
},
{
"cve": "CVE-2026-126166",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Argument Delimiters in a Command",
"title": "CWE-88"
},
{
"category": "description",
"text": "Fortinet FortiMail versions 7.2 through 8.0.2 contain an argument injection vulnerability (CWE-88) that allows authenticated admin users to delete users from other tenant domains on paired FortiAuthenticator devices, execute arbitrary root code or CLI commands, and read or write files via crafted HTTP requests to the admin interface.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-126166 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126166.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L/E:P/RL:U/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-126166"
},
{
"cve": "CVE-2026-126167",
"cwe": {
"id": "CWE-77",
"name": "Improper Neutralization of Special Elements used in a Command"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Special Elements used in a Command",
"title": "CWE-77"
},
{
"category": "description",
"text": "An argument injection vulnerability (CWE-88) in Fortinet FortiMail allows authenticated admin users to delete tenant users on paired FortiAuthenticator devices, execute arbitrary root code or CLI commands, and read or write files via crafted HTTP requests to the admin interface.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-126167 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126167.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L/E:P/RL:U/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-126167"
},
{
"cve": "CVE-2026-126168",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Argument Delimiters in a Command",
"title": "CWE-88"
},
{
"category": "description",
"text": "Fortinet FortiMail versions 7.2 through 8.0.2 contain an argument injection vulnerability (CWE-88) that allows authenticated admin users to delete users from other tenant domains on paired FortiAuthenticator devices, execute arbitrary root code or CLI commands, and read or write files via crafted HTTP requests to the admin interface.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-126168 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126168.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L/E:P/RL:U/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-126168"
},
{
"cve": "CVE-2026-126169",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Argument Delimiters in a Command",
"title": "CWE-88"
},
{
"category": "description",
"text": "Fortinet FortiMail versions 7.2 through 8.0.2 contain an argument injection vulnerability (CWE-88) that allows authenticated admin users to delete users from other tenant domains on paired FortiAuthenticator devices, execute arbitrary root code or CLI commands, and read or write files via crafted HTTP requests to the admin interface.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-126169 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126169.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L/E:P/RL:U/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-126169"
},
{
"cve": "CVE-2026-126263",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Special Elements used in an SQL Command",
"title": "CWE-89"
},
{
"category": "description",
"text": "An SQL injection vulnerability in Fortinet FortiMail versions 7.4.0 to 8.0.1 allows authenticated attackers to execute unauthorized code or commands via specially crafted requests.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-126263 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126263.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-126263"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.