# Fortinet patches 24 FortiMail vulnerabilities

Published: 2026-11-12 · Severity: routine
Canonical: https://vorant.io/reports/1b304005-59b5-56d8-a7a7-10058c0251b5/fortinet-patches-24-fortimail-vulnerabilities
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> Fortinet fixed 24 vulnerabilities in FortiMail versions 7.2–8.0.2, including unauthenticated flaws enabling root-level command execution and auth bypass.

Source: advisories.ncsc.nl — https://advisories.ncsc.nl/2026/ncsc-2026-0487.html

## What to check

- Applies to: The 27 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

NCSC-NL issued an advisory summarizing 24 vulnerabilities patched by Fortinet in its FortiMail secure email gateway, affecting versions between 7.2 and 8.0.2. The flaws span a wide range of weakness classes including OS command injection, path traversal, SQL injection, XML injection, argument injection, authentication and authorization bypass, weak password-recovery mechanisms, out-of-bounds writes, integer overflows, and resource exhaustion issues. Several of the vulnerabilities carry CVSS v3 scores of 9.1–9.8, reflecting their potential for unauthenticated exploitation.

Exploitation of these flaws could allow attackers to execute arbitrary commands at root level, bypass authentication and authorization controls, reset webmail user passwords, read and send encrypted emails on behalf of other users, delete users in multi-tenant deployments, and cause denial-of-service through crashes or resource exhaustion. The affected functionality spans core mail processing, webmail interfaces, administrative interfaces, and integration with FortiAuthenticator. No evidence of in-the-wild exploitation is noted in the advisory.

Defenders running FortiMail within the affected version range (7.2 through 8.0.2) should prioritize patching per Fortinet's PSIRT advisories (FG-IR-26-196 through FG-IR-26-218 and FG-IR-26-277), giving particular attention to the unauthenticated, critical-severity issues (e.g., CVE-2026-126147, CVE-2026-126148, CVE-2026-126263, each CVSS 9.8) given the mail gateway's typical internet-facing exposure.

## Mentioned in this report

- Vulnerabilities: CVE-2026-126144, CVE-2026-126145, CVE-2026-126146, CVE-2026-126147, CVE-2026-126148, CVE-2026-126149, CVE-2026-126150, CVE-2026-126151, CVE-2026-126152, CVE-2026-126153, CVE-2026-126154, CVE-2026-126155, CVE-2026-126156, CVE-2026-126157, CVE-2026-126158, CVE-2026-126159, CVE-2026-126160, CVE-2026-126161, CVE-2026-126162, CVE-2026-126163, CVE-2026-126164, CVE-2026-126165, CVE-2026-126166, CVE-2026-126167, CVE-2026-126168, CVE-2026-126169, CVE-2026-126263

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0487.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/1b304005-59b5-56d8-a7a7-10058c0251b5/fortinet-patches-24-fortimail-vulnerabilities.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup