{"affected":[{"defaultStatus":"unaffected","product":"FortiMail","source":"CNA: fortinet","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"cveId":"CVE-2026-126151","cwes":["CWE-303"],"description":"A incorrect implementation of authentication algorithm vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to gain elevation of privilege (account takeover) via a crafted request.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: fortinet","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:R","version":"3.1"}],"modifiedAt":1794432554136,"publishedAt":1794432554136,"references":[{"source":"CNA: fortinet","tags":[],"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-203"}],"remediation":[{"kind":"fix","source":"CNA: fortinet","text":"Upgrade to FortiMail version 8.0.2 or above\nUpgrade to FortiMail version 7.6.7 or above\nUpgrade to FortiMail version 7.4.9 or above"}],"revision":"b181bb2355e6dcc6b660cfd5612abeb93ce5e16ac0c7eb49ccc5b2cd3b0b12c1","sources":[{"modifiedAt":1794432554136,"name":"CNA: fortinet","retrievedAt":1794434942518,"url":"https://www.cve.org/CVERecord?id=CVE-2026-126151"}],"ssvc":null,"status":"published","title":"CVE-2026-126151","updatedAt":1794434942518}