# Fortinet FortiMail vulnerabilities Source: https://junglewise.ai/threats/technologies/fortimail Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/fortimail.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 31 vulnerabilities in Fortinet FortiMail: 27 in the last 7 days and 29 in the last 90 days, 9 of them critical and 1 exploited in the wild. The most recent, CVE-2026-126263, was published on 11 November 2026. 1 vulnerability in the last four weeks, level on the four before (1). 0 critical against 1, 0 exploited in the wild against 1. ## Counts - Last 7 days: 27 - Last 30 days: 27 - Last 90 days: 29 - All time: 31 (9 critical, 1 exploited in the wild) ## About Fortinet FortiMail An email security gateway that protects against volume-based and targeted attacks. ## Latest Fortinet FortiMail vulnerabilities - [CVE-2026-126263: Fortinet FortiMail SQL injection](https://junglewise.ai/threats/cve-2026-126263-a-improper-neutralization-of-special-elements-used-in-an-sql) (critical, CVSS 9.8, published 11 Nov 2026) - [CVE-2026-126169: Fortinet FortiMail argument injection in administrative interface](https://junglewise.ai/threats/cve-2026-126169-a-improper-neutralization-of-argument-delimiters-in-a-command) (high, CVSS 7.2, published 11 Nov 2026) - [CVE-2026-126168: Fortinet FortiMail argument injection in administrative interface](https://junglewise.ai/threats/cve-2026-126168-a-improper-neutralization-of-argument-delimiters-in-a-command) (high, CVSS 7.2, published 11 Nov 2026) - [CVE-2026-126167: Fortinet FortiMail command injection in admin GUI](https://junglewise.ai/threats/cve-2026-126167-a-improper-neutralization-of-special-elements-used-in-a-command) (high, CVSS 7.2, published 11 Nov 2026) - [CVE-2026-126166: Fortinet FortiMail argument injection in admin interface](https://junglewise.ai/threats/cve-2026-126166-a-improper-neutralization-of-argument-delimiters-in-a-command) (high, CVSS 7.2, published 11 Nov 2026) - [CVE-2026-126165: Fortinet FortiMail memory allocation DoS](https://junglewise.ai/threats/cve-2026-126165-a-memory-allocation-with-excessive-size-value-vulnerability-in) (high, CVSS 7.5, published 11 Nov 2026) - [CVE-2026-126164: Fortinet FortiMail SQL injection](https://junglewise.ai/threats/cve-2026-126164-a-improper-neutralization-of-special-elements-used-in-an-sql) (critical, CVSS 9.4, published 11 Nov 2026) - [CVE-2026-126163: Fortinet FortiMail format string in SMTP](https://junglewise.ai/threats/cve-2026-126163-a-use-of-externally-controlled-format-string-vulnerability-in) (high, CVSS 8.1, published 11 Nov 2026) - [CVE-2026-126162: Fortinet FortiMail XML injection in Exchange Integration](https://junglewise.ai/threats/cve-2026-126162-a-xml-injection-aka-blind-xpath-injection-vulnerability-in) (high, CVSS 8.7, published 11 Nov 2026) - [CVE-2026-126161: Fortinet FortiMail uncontrolled resource consumption](https://junglewise.ai/threats/cve-2026-126161-a-uncontrolled-resource-consumption-vulnerability-in-fortinet) (high, CVSS 7.5, published 11 Nov 2026) - [CVE-2026-126160: Fortinet FortiMail improper authentication in quarantine release](https://junglewise.ai/threats/cve-2026-126160-a-improper-authentication-vulnerability-in-fortinet-fortimail-8) (high, CVSS 8.2, published 11 Nov 2026) - [CVE-2026-126159: Fortinet FortiMail authorization bypass in quarantine API](https://junglewise.ai/threats/cve-2026-126159-a-authorization-bypass-through-user-controlled-key-vulnerability) (high, CVSS 7.5, published 11 Nov 2026) - [CVE-2026-126158: Fortinet FortiMail OS command injection via HTTP API](https://junglewise.ai/threats/cve-2026-126158-a-improper-neutralization-of-special-elements-used-in-an-os) (high, CVSS 7.2, published 11 Nov 2026) - [CVE-2026-126157: Fortinet FortiMail authentication bypass](https://junglewise.ai/threats/cve-2026-126157-a-improper-authentication-vulnerability-in-fortinet-fortimail-8) (critical, CVSS 9.1, published 11 Nov 2026) - [CVE-2026-126156: Fortinet FortiMail authorization bypass in IBE recipient account](https://junglewise.ai/threats/cve-2026-126156-a-authorization-bypass-through-user-controlled-key-vulnerability) (critical, CVSS 9.1, published 11 Nov 2026) - [CVE-2026-126155: Fortinet FortiMail incorrect authorization](https://junglewise.ai/threats/cve-2026-126155-a-incorrect-authorization-vulnerability-in-fortinet-fortimail-8) (critical, CVSS 9.1, published 11 Nov 2026) - [CVE-2026-126154: Fortinet FortiMail out-of-bounds write in API](https://junglewise.ai/threats/cve-2026-126154-a-out-of-bounds-write-vulnerability-in-fortinet-fortimail-8-0-0) (high, CVSS 7.5, published 11 Nov 2026) - [CVE-2026-126153: Fortinet FortiMail path traversal in API](https://junglewise.ai/threats/cve-2026-126153-a-improper-limitation-of-a-pathname-to-a-restricted-directory) (high, CVSS 7.5, published 11 Nov 2026) - [CVE-2026-126152: Fortinet FortiMail authorization bypass in user-controlled key](https://junglewise.ai/threats/cve-2026-126152-a-authorization-bypass-through-user-controlled-key-vulnerability) (high, CVSS 7.6, published 11 Nov 2026) - [CVE-2026-126151: Fortinet FortiMail authentication algorithm bypass](https://junglewise.ai/threats/cve-2026-126151-a-incorrect-implementation-of-authentication-algorithm) (high, CVSS 7.5, published 11 Nov 2026) - [CVE-2026-126150: Fortinet FortiMail weak password recovery authentication bypass](https://junglewise.ai/threats/cve-2026-126150-a-weak-password-recovery-mechanism-for-forgotten-password) (critical, CVSS 9.1, published 11 Nov 2026) - [CVE-2026-126149: Fortinet FortiMail integer overflow in smtpd](https://junglewise.ai/threats/cve-2026-126149-a-integer-overflow-or-wraparound-vulnerability-in-fortinet) (high, CVSS 7.5, published 11 Nov 2026) - [CVE-2026-126148: Fortinet FortiMail OS command injection in HA join-request](https://junglewise.ai/threats/cve-2026-126148-a-improper-neutralization-of-special-elements-used-in-an-os) (critical, CVSS 9.8, published 11 Nov 2026) - [CVE-2026-126147: Fortinet FortiMail path traversal in API](https://junglewise.ai/threats/cve-2026-126147-a-improper-limitation-of-a-pathname-to-a-restricted-directory) (critical, CVSS 9.8, published 11 Nov 2026) - [CVE-2026-126146: Fortinet FortiMail OS command injection in archive configuration](https://junglewise.ai/threats/cve-2026-126146-a-improper-neutralization-of-special-elements-used-in-an-os) (high, CVSS 7.2, published 11 Nov 2026) ## Most severe Fortinet FortiMail vulnerabilities - [CVE-2026-104286: Fortinet FortiMail path traversal vulnerability](https://junglewise.ai/threats/cve-2026-104286-fortinet-fortimail-path-traversal-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 1 Oct 2026) - [CVE-2026-126263: Fortinet FortiMail SQL injection](https://junglewise.ai/threats/cve-2026-126263-a-improper-neutralization-of-special-elements-used-in-an-sql) (critical, CVSS 9.8, published 11 Nov 2026) - [CVE-2026-126148: Fortinet FortiMail OS command injection in HA join-request](https://junglewise.ai/threats/cve-2026-126148-a-improper-neutralization-of-special-elements-used-in-an-os) (critical, CVSS 9.8, published 11 Nov 2026) - [CVE-2026-126147: Fortinet FortiMail path traversal in API](https://junglewise.ai/threats/cve-2026-126147-a-improper-limitation-of-a-pathname-to-a-restricted-directory) (critical, CVSS 9.8, published 11 Nov 2026) - [CVE-2026-126164: Fortinet FortiMail SQL injection](https://junglewise.ai/threats/cve-2026-126164-a-improper-neutralization-of-special-elements-used-in-an-sql) (critical, CVSS 9.4, published 11 Nov 2026) - [CVE-2026-126157: Fortinet FortiMail authentication bypass](https://junglewise.ai/threats/cve-2026-126157-a-improper-authentication-vulnerability-in-fortinet-fortimail-8) (critical, CVSS 9.1, published 11 Nov 2026) - [CVE-2026-126156: Fortinet FortiMail authorization bypass in IBE recipient account](https://junglewise.ai/threats/cve-2026-126156-a-authorization-bypass-through-user-controlled-key-vulnerability) (critical, CVSS 9.1, published 11 Nov 2026) - [CVE-2026-126155: Fortinet FortiMail incorrect authorization](https://junglewise.ai/threats/cve-2026-126155-a-incorrect-authorization-vulnerability-in-fortinet-fortimail-8) (critical, CVSS 9.1, published 11 Nov 2026) - [CVE-2026-126150: Fortinet FortiMail weak password recovery authentication bypass](https://junglewise.ai/threats/cve-2026-126150-a-weak-password-recovery-mechanism-for-forgotten-password) (critical, CVSS 9.1, published 11 Nov 2026) - [CVE-2025-57739: Fortinet FortiMail SQL injection in webmail](https://junglewise.ai/threats/cve-2025-57739-an-improper-neutralization-of-special-elements-used-in-an-sql) (high, CVSS 8.8, published 13 Oct 2026) ## Vulnerabilities per week 1 vulnerability in the last four weeks, level on the four before (1). 0 critical against 1, 0 exploited in the wild against 1. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 1 | 1 | 1 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 1 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 27 | 8 | 0 | ## Other Fortinet technologies - [Fortinet FortiOS](https://junglewise.ai/threats/technologies/fortios): 66 vulnerabilities - [Fortinet FortiManager](https://junglewise.ai/threats/technologies/fortimanager): 54 vulnerabilities - [Fortinet FortiManager Cloud](https://junglewise.ai/threats/technologies/fortimanager-cloud): 48 vulnerabilities - [Fortinet FortiAnalyzer](https://junglewise.ai/threats/technologies/fortianalyzer): 47 vulnerabilities - [Fortinet Fortianalyzer Cloud](https://junglewise.ai/threats/technologies/fortianalyzer-cloud): 42 vulnerabilities - [Fortinet FortiProxy](https://junglewise.ai/threats/technologies/fortiproxy): 35 vulnerabilities - [Fortinet FortiAuthenticator](https://junglewise.ai/threats/technologies/fortiauthenticator): 22 vulnerabilities - [Fortinet FortiSandbox](https://junglewise.ai/threats/technologies/fortisandbox): 17 vulnerabilities - [Fortinet FortiWeb](https://junglewise.ai/threats/technologies/fortiweb): 16 vulnerabilities - [Fortinet Fortisase](https://junglewise.ai/threats/technologies/fortisase): 13 vulnerabilities - [Fortinet FortiPAM](https://junglewise.ai/threats/technologies/fortipam): 12 vulnerabilities - [Fortinet FortiSandbox Cloud](https://junglewise.ai/threats/technologies/fortisandbox-cloud): 12 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Fortinet FortiMail vulnerabilities", https://junglewise.ai/threats/technologies/fortimail, 13 November 2026.