{"affected":[{"defaultStatus":"unaffected","product":"FortiMail","source":"CNA: fortinet","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"cveId":"CVE-2026-126160","cwes":["CWE-287"],"description":"A improper authentication vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to escalate privileges and release or delete quarantined messages for arbitrary mailboxes via a crafted quarantine release requests.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.2,"severity":"high","source":"CNA: fortinet","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L/E:P/RL:O/RC:C","version":"3.1"}],"modifiedAt":1794432559376,"publishedAt":1794432559376,"references":[{"source":"CNA: fortinet","tags":[],"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-212"}],"remediation":[{"kind":"fix","source":"CNA: fortinet","text":"Upgrade to FortiMail version 8.0.2 or above\nUpgrade to FortiMail version 7.6.7 or above\nUpgrade to FortiMail version 7.4.9 or above"}],"revision":"42cb39d31a89dbdb1e15a4077e6491d93652bcfc88d3bab4f4371dcd805bac14","sources":[{"modifiedAt":1794432559376,"name":"CNA: fortinet","retrievedAt":1794434952723,"url":"https://www.cve.org/CVERecord?id=CVE-2026-126160"}],"ssvc":null,"status":"published","title":"CVE-2026-126160","updatedAt":1794434952723}