Fortinet patches 24 FortiMail vulnerabilities
Fortinet fixed 24 vulnerabilities in FortiMail versions 7.2–8.0.2, including unauthenticated flaws enabling root-level command execution and auth bypass.
Sourceadvisories.ncsc.nl — open the original
What to check
- Applies to
- The 27 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
NCSC-NL issued an advisory summarizing 24 vulnerabilities patched by Fortinet in its FortiMail secure email gateway, affecting versions between 7.2 and 8.0.2. The flaws span a wide range of weakness classes including OS command injection, path traversal, SQL injection, XML injection, argument injection, authentication and authorization bypass, weak password-recovery mechanisms, out-of-bounds writes, integer overflows, and resource exhaustion issues. Several of the vulnerabilities carry CVSS v3 scores of 9.1–9.8, reflecting their potential for unauthenticated exploitation.
Exploitation of these flaws could allow attackers to execute arbitrary commands at root level, bypass authentication and authorization controls, reset webmail user passwords, read and send encrypted emails on behalf of other users, delete users in multi-tenant deployments, and cause denial-of-service through crashes or resource exhaustion. The affected functionality spans core mail processing, webmail interfaces, administrative interfaces, and integration with FortiAuthenticator. No evidence of in-the-wild exploitation is noted in the advisory.
Defenders running FortiMail within the affected version range (7.2 through 8.0.2) should prioritize patching per Fortinet's PSIRT advisories (FG-IR-26-196 through FG-IR-26-218 and FG-IR-26-277), giving particular attention to the unauthenticated, critical-severity issues (e.g., CVE-2026-126147, CVE-2026-126148, CVE-2026-126263, each CVSS 9.8) given the mail gateway's typical internet-facing exposure.
Mentioned in this report
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0487.html
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs