{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "nl", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." }, { "category": "description", "text": "Fortinet heeft meerdere kwetsbaarheden verholpen in FortiMail.", "title": "Feiten" }, { "category": "description", "text": "De kwetsbaarheden in FortiMail betreffen onder andere OS command injection, path traversal, SQL-injectie, authenticatie- en autorisatieproblemen, argument injection, XML-injectie, en resource consumptie. Sommige kwetsbaarheden kunnen door ongeauthenticeerde aanvallers worden misbruikt, terwijl andere authenticatie vereisen. Exploitatie kan leiden tot het uitvoeren van ongeautoriseerde commando's op root-niveau, het omzeilen van authenticatie en autorisatie, het resetten van wachtwoorden van webmailgebruikers, het lezen en verzenden van versleutelde e-mails namens andere gebruikers, het verwijderen van gebruikers in multi-tenant omgevingen, en het veroorzaken van denial-of-service door crashes of resource uitputting. De kwetsbaarheden beïnvloeden verschillende versies van FortiMail, met name versies tussen 7.2 en 8.0.2, en hebben impact op kernfunctionaliteiten zoals mailverwerking, webmailinterfaces, administratieve interfaces, en integratie met FortiAuthenticator.", "title": "Interpretaties" }, { "category": "description", "text": "Fortinet heeft updates uitgebracht om de kwetsbaarheden in FortiMail te verhelpen. Zie bijgevoegde referenties voor meer informatie.", "title": "Oplossingen" }, { "category": "general", "text": "medium", "title": "Kans" }, { "category": "general", "text": "high", "title": "Schade" }, { "category": "general", "text": "Improper Limitation of a Pathname to a Restricted Directory", "title": "CWE-22" }, { "category": "general", "text": "Improper Neutralization of Special Elements used in a Command", "title": "CWE-77" }, { "category": "general", "text": "Improper Neutralization of Special Elements used in an OS Command", "title": "CWE-78" }, { "category": "general", "text": "Improper Neutralization of Argument Delimiters in a Command", "title": "CWE-88" }, { "category": "general", "text": "Improper Neutralization of Special Elements used in an SQL Command", "title": "CWE-89" }, { "category": "general", "text": "XML Injection", "title": "CWE-91" }, { "category": "general", "text": "Use of Externally-Controlled Format String", "title": "CWE-134" }, { "category": "general", "text": "Integer Overflow or Wraparound", "title": "CWE-190" }, { "category": "general", "text": "Incorrect Implementation of Authentication Algorithm", "title": "CWE-303" }, { "category": "general", "text": "Authorization Bypass Through User-Controlled Key", "title": "CWE-639" }, { "category": "general", "text": "Weak Password Recovery Mechanism for Forgotten Password", "title": "CWE-640" }, { "category": "general", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "general", "text": "Memory Allocation with Excessive Size Value", "title": "CWE-789" }, { "category": "general", "text": "Incorrect Authorization", "title": "CWE-863" } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "Nationaal Cyber Security Centrum", "namespace": "https://www.ncsc.nl/" }, "references": [ { "category": "external", "summary": "Reference", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-196" }, { "category": "external", "summary": "Reference", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-197" }, { "category": "external", "summary": "Reference", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-198" }, { "category": "external", "summary": "Reference", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-199" }, { "category": "external", "summary": "Reference", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-200" }, { "category": "external", "summary": "Reference", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-201" }, { "category": "external", "summary": "Reference", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-202" }, { "category": "external", "summary": "Reference", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-203" }, { "category": "external", "summary": "Reference", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-204" }, { "category": "external", "summary": "Reference", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-205" }, { "category": "external", "summary": "Reference", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-206" }, { "category": "external", "summary": "Reference", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-207" }, { "category": "external", "summary": "Reference", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-208" }, { "category": "external", "summary": "Reference", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-209" }, { "category": "external", "summary": "Reference", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-210" }, { "category": "external", "summary": "Reference", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-211" }, { "category": "external", "summary": "Reference", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-212" }, { "category": "external", "summary": "Reference", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-213" }, { "category": "external", "summary": "Reference", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-214" }, { "category": "external", "summary": "Reference", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-215" }, { "category": "external", "summary": "Reference", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-216" }, { "category": "external", "summary": "Reference", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-217" }, { "category": "external", "summary": "Reference", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-218" }, { "category": "external", "summary": "Reference", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-277" } ], "title": "Kwetsbaarheden verholpen in Fortinet FortiMail", "tracking": { "current_release_date": "2026-11-12T08:54:20.264598Z", "generator": { "date": "2025-08-04T16:30:00Z", "engine": { "name": "V.A.", "version": "1.3" } }, "id": "NCSC-2026-0487", "initial_release_date": "2026-11-12T08:54:20.264598Z", "revision_history": [ { "date": "2026-11-12T08:54:20.264598Z", "number": "1.0.0", "summary": "Initiele versie" } ], "status": "final", "version": "1.0.0" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-1" } } ], "category": "product_name", "name": "FortiMail" } ], "category": "vendor", "name": "Fortinet" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-126144", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements used in an OS Command", "title": "CWE-78" }, { "category": "description", "text": "An OS Command Injection vulnerability in multiple versions of FortiMail, FortiRecorder, and FortiVoice allows authenticated attackers to execute unauthorized commands via specially crafted HTTP requests.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-126144 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126144.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C", "baseScore": 8.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-126144" }, { "cve": "CVE-2026-126145", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements used in an OS Command", "title": "CWE-78" }, { "category": "description", "text": "Fortinet FortiMail versions 7.2 through 8.0.1 contain an OS Command Injection vulnerability (CWE-78) that allows an authenticated administrator with system-time read-write access to execute unauthorized root-level commands.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-126145 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126145.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C", "baseScore": 7.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-126145" }, { "cve": "CVE-2026-126146", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements used in an OS Command", "title": "CWE-78" }, { "category": "description", "text": "An OS Command Injection vulnerability in Fortinet FortiMail (7.2.0 to 8.0.1) and FortiRecorder (7.0.0 to 7.6.0) allows an authenticated privileged attacker to execute unauthorized commands via a specially crafted archive account configuration.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-126146 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126146.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C", "baseScore": 7.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-126146" }, { "cve": "CVE-2026-126147", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory" }, "notes": [ { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory", "title": "CWE-22" }, { "category": "description", "text": "A path traversal vulnerability in multiple versions of Fortinet FortiMail allows unauthenticated attackers to execute unauthorized code or commands via crafted requests.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-126147 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126147.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:R", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-126147" }, { "cve": "CVE-2026-126148", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements used in an OS Command", "title": "CWE-78" }, { "category": "description", "text": "Fortinet FortiMail versions 7.6.0 to 7.6.6 and 8.0.0 to 8.0.1 contain an OS command injection vulnerability via crafted HA join-request packets, allowing unauthenticated attackers to execute unauthorized commands.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-126148 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126148.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:R", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-126148" }, { "cve": "CVE-2026-126149", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "other", "text": "Integer Overflow or Wraparound", "title": "CWE-190" }, { "category": "description", "text": "An integer overflow vulnerability in multiple versions of Fortinet FortiMail may allow a remote unauthenticated attacker to crash the daemon, potentially disrupting mail services.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-126149 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126149.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-126149" }, { "cve": "CVE-2026-126150", "cwe": { "id": "CWE-640", "name": "Weak Password Recovery Mechanism for Forgotten Password" }, "notes": [ { "category": "other", "text": "Weak Password Recovery Mechanism for Forgotten Password", "title": "CWE-640" }, { "category": "description", "text": "A vulnerability in Fortinet FortiMail versions 7.2.0 to 8.0.0 allows unauthenticated attackers to reset any IBE webmail user's password and take over their account via crafted HTTP requests exploiting a weak password recovery mechanism.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-126150 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126150.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:R", "baseScore": 9.1, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-126150" }, { "cve": "CVE-2026-126151", "cwe": { "id": "CWE-303", "name": "Incorrect Implementation of Authentication Algorithm" }, "notes": [ { "category": "other", "text": "Incorrect Implementation of Authentication Algorithm", "title": "CWE-303" }, { "category": "description", "text": "Multiple versions of Fortinet FortiMail contain an authentication algorithm flaw that allows unauthenticated remote attackers to elevate privileges and compromise accounts via crafted requests.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-126151 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126151.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:R", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-126151" }, { "cve": "CVE-2026-126152", "cwe": { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key" }, "notes": [ { "category": "other", "text": "Authorization Bypass Through User-Controlled Key", "title": "CWE-639" }, { "category": "description", "text": "An authorization bypass vulnerability in Fortinet FortiMail allows authenticated remote attackers to delete arbitrary directories as root or access and delete other users' calendar and mailbox data across tenant domains via crafted HTTP requests.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-126152 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126152.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:U/RL:U/RC:R", "baseScore": 8.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-126152" }, { "cve": "CVE-2026-126153", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory" }, "notes": [ { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory", "title": "CWE-22" }, { "category": "description", "text": "A path traversal vulnerability in multiple versions of Fortinet FortiMail allows unauthenticated attackers to execute unauthorized commands via crafted requests.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-126153 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126153.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-126153" }, { "cve": "CVE-2026-126154", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "Multiple versions of Fortinet FortiMail contain an out-of-bounds write vulnerability that allows remote unauthenticated attackers to cause denial of service via specially crafted HTTP requests.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-126154 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126154.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-126154" }, { "cve": "CVE-2026-126155", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "notes": [ { "category": "other", "text": "Incorrect Authorization", "title": "CWE-863" }, { "category": "description", "text": "Fortinet FortiMail versions 7.2 through 8.0.1 contain an incorrect authorization vulnerability allowing unauthenticated remote attackers to access any recipient's authenticated IBE webmail session and read or send encrypted mail via crafted HTTP requests.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-126155 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126155.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:R", "baseScore": 9.1, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-126155" }, { "cve": "CVE-2026-126156", "cwe": { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key" }, "notes": [ { "category": "other", "text": "Authorization Bypass Through User-Controlled Key", "title": "CWE-639" }, { "category": "description", "text": "An authorization bypass vulnerability in Fortinet FortiMail allows unauthenticated remote attackers to take over arbitrary IBE recipient accounts via crafted HTTP requests.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-126156 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126156.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C", "baseScore": 9.1, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-126156" }, { "cve": "CVE-2026-126157", "notes": [ { "category": "description", "text": "An improper authentication vulnerability in multiple versions of Fortinet FortiMail allows unauthenticated attackers to access other users' secure email accounts via crafted HTTP requests.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-126157 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126157.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C", "baseScore": 9.1, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-126157" }, { "cve": "CVE-2026-126158", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements used in an OS Command", "title": "CWE-78" }, { "category": "description", "text": "Fortinet FortiMail versions 8.0.0 through 8.0.1 contain an OS Command Injection vulnerability (CWE-78) that allows an authenticated administrator to execute unauthorized root-level commands via specially crafted HTTP requests.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-126158 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126158.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C", "baseScore": 7.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-126158" }, { "cve": "CVE-2026-126159", "cwe": { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key" }, "notes": [ { "category": "other", "text": "Authorization Bypass Through User-Controlled Key", "title": "CWE-639" }, { "category": "description", "text": "An authorization bypass vulnerability in Fortinet FortiMail allows unauthenticated attackers to release or delete quarantined messages for arbitrary mailboxes via crafted quarantine release requests.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-126159 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126159.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-126159" }, { "cve": "CVE-2026-126160", "notes": [ { "category": "description", "text": "Fortinet FortiMail versions 7.2 through 8.0.1 contain an improper authentication vulnerability allowing unauthenticated attackers to escalate privileges and manipulate quarantined messages via crafted quarantine release requests.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-126160 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126160.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L/E:P/RL:O/RC:C", "baseScore": 8.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-126160" }, { "cve": "CVE-2026-126161", "notes": [ { "category": "description", "text": "An uncontrolled resource consumption vulnerability in Fortinet FortiMail versions 7.4.0 to 7.4.6, 7.6.0 to 7.6.6, and 8.0.0 to 8.0.1 allows remote unauthenticated attackers to cause denial of service via repeated unauthenticated POST requests.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-126161 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126161.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-126161" }, { "cve": "CVE-2026-126162", "cwe": { "id": "CWE-91", "name": "XML Injection" }, "notes": [ { "category": "other", "text": "XML Injection", "title": "CWE-91" }, { "category": "description", "text": "A vulnerability in Fortinet FortiMail versions 7.6.0 to 7.6.6 and 8.0.0 to 8.0.1 allows remote unauthenticated attackers to execute unauthorized code via a specially crafted blind XPath XML injection request.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-126162 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126162.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "baseScore": 8.7, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-126162" }, { "cve": "CVE-2026-126163", "cwe": { "id": "CWE-134", "name": "Use of Externally-Controlled Format String" }, "notes": [ { "category": "other", "text": "Use of Externally-Controlled Format String", "title": "CWE-134" }, { "category": "description", "text": "A remote unauthenticated attacker can execute unauthorized code or commands on Fortinet FortiMail versions 8.0.0 to 8.0.1 via a specially crafted SMTP command.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-126163 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126163.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C", "baseScore": 8.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-126163" }, { "cve": "CVE-2026-126164", "cwe": { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements used in an SQL Command", "title": "CWE-89" }, { "category": "description", "text": "Fortinet FortiMail versions 7.2 through 8.0.1 contain an SQL injection vulnerability that allows unauthenticated attackers to execute unauthorized code or commands via crafted requests.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-126164 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126164.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C", "baseScore": 9.4, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-126164" }, { "cve": "CVE-2026-126165", "cwe": { "id": "CWE-789", "name": "Memory Allocation with Excessive Size Value" }, "notes": [ { "category": "other", "text": "Memory Allocation with Excessive Size Value", "title": "CWE-789" }, { "category": "description", "text": "A vulnerability in Fortinet FortiMail versions 7.2 through 8.0.1 allows remote unauthenticated attackers to cause denial of service via a specially crafted SMTP attachment triggering excessive memory allocation.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-126165 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126165.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-126165" }, { "cve": "CVE-2026-126166", "cwe": { "id": "CWE-88", "name": "Improper Neutralization of Argument Delimiters in a Command" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Argument Delimiters in a Command", "title": "CWE-88" }, { "category": "description", "text": "Fortinet FortiMail versions 7.2 through 8.0.2 contain an argument injection vulnerability (CWE-88) that allows authenticated admin users to delete users from other tenant domains on paired FortiAuthenticator devices, execute arbitrary root code or CLI commands, and read or write files via crafted HTTP requests to the admin interface.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-126166 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126166.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L/E:P/RL:U/RC:C", "baseScore": 7.6, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-126166" }, { "cve": "CVE-2026-126167", "cwe": { "id": "CWE-77", "name": "Improper Neutralization of Special Elements used in a Command" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements used in a Command", "title": "CWE-77" }, { "category": "description", "text": "An argument injection vulnerability (CWE-88) in Fortinet FortiMail allows authenticated admin users to delete tenant users on paired FortiAuthenticator devices, execute arbitrary root code or CLI commands, and read or write files via crafted HTTP requests to the admin interface.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-126167 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126167.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L/E:P/RL:U/RC:C", "baseScore": 7.6, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-126167" }, { "cve": "CVE-2026-126168", "cwe": { "id": "CWE-88", "name": "Improper Neutralization of Argument Delimiters in a Command" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Argument Delimiters in a Command", "title": "CWE-88" }, { "category": "description", "text": "Fortinet FortiMail versions 7.2 through 8.0.2 contain an argument injection vulnerability (CWE-88) that allows authenticated admin users to delete users from other tenant domains on paired FortiAuthenticator devices, execute arbitrary root code or CLI commands, and read or write files via crafted HTTP requests to the admin interface.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-126168 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126168.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L/E:P/RL:U/RC:C", "baseScore": 7.6, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-126168" }, { "cve": "CVE-2026-126169", "cwe": { "id": "CWE-88", "name": "Improper Neutralization of Argument Delimiters in a Command" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Argument Delimiters in a Command", "title": "CWE-88" }, { "category": "description", "text": "Fortinet FortiMail versions 7.2 through 8.0.2 contain an argument injection vulnerability (CWE-88) that allows authenticated admin users to delete users from other tenant domains on paired FortiAuthenticator devices, execute arbitrary root code or CLI commands, and read or write files via crafted HTTP requests to the admin interface.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-126169 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126169.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L/E:P/RL:U/RC:C", "baseScore": 7.6, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-126169" }, { "cve": "CVE-2026-126263", "cwe": { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements used in an SQL Command", "title": "CWE-89" }, { "category": "description", "text": "An SQL injection vulnerability in Fortinet FortiMail versions 7.4.0 to 8.0.1 allows authenticated attackers to execute unauthorized code or commands via specially crafted requests.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-126263 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126263.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-126263" } ] }