CVE WatchNov 11, 2026

CVE-2026-126150

A weak password recovery mechanism for forgotten password vulnerability in Fortinet FortiMail 8.0.0, FortiMail 7.6.0 through 7.6.5, FortiMai

CVSS

9.1

Critical

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Nov 11, 2026 · Last modified: Nov 11, 2026 · CWE-640

EPSS · 30d

Not enough EPSS history yet.

Technical description

A weak password recovery mechanism for forgotten password vulnerability in Fortinet FortiMail 8.0.0, FortiMail 7.6.0 through 7.6.5, FortiMail 7.4.0 through 7.4.7, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to reset the password of an arbitrary IBE webmail user and take over their account via specially crafted HTTP requests.

Official references

fortiguard.fortinet.comhttps://fortiguard.fortinet.com/psirt/FG-IR-26-202

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1187418.1 HIG

55.6%

——17Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.14h CVE-2026-600467.5 HIG

24.9%

——7An unauthenticated remote attacker can perform password resets for any user with known username and email without rate limiting. This can result in a total loss of availabilit since the password will be reseted.1d CVE-2026-1250747.3 HIG

22.3%

——7A flaw has been found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown function of the file reset_password.php of the component Password Reset. This manipulation of the argument username/password causes weak password recovery. The attack is possible to be carried out remotely. The exploit has been published and may be used.2d CVE-2026-118459—

25.6%

——8A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials.3d CVE-2026-1231968.1 HIG

29.8%

——9Authorizer before 2.4.2 contains a password reset poisoning vulnerability that allows unauthenticated attackers to control emailed link hosts by supplying x-authorizer-url gRPC metadata. Attackers can send this metadata to the gRPC port or a Grpc-Metadata-X-Authorizer-Url header through the REST gateway to capture reset or magic-link tokens and take over accounts.2d CVE-2026-114421—

23.1%

——7SEPPmail Secure Email Gateway before 15.1.1 permits password recovery for a created but unregistered GINA account whose initial password is empty without adequately verifying ownership. A remote unauthenticated attacker who identifies such an account can set a new password, authenticate as that account, and prevent the intended recipient from using it until recovery.2d