Fortinet has patched five critical flaws in FortiMail, including two that need no login at all to exploit. The fixes arrived on 10 November in a release of roughly 89 advisories, more than a dozen rated critical.

The most severe is CVE-2026-126147, an unauthenticated path traversal flaw scored 9.8 out of 10, which may let an attacker run unauthorised code or commands via crafted requests. A second flaw, CVE-2026-126148, also scored 9.8, allows unauthenticated command injection through high-availability join-request packets. A third, CVE-2026-126164, is an unauthenticated SQL injection flaw scored 9.4.

Two more flaws target webmail accounts

The remaining two critical flaws, CVE-2026-126155 and CVE-2026-126156, are authorisation bypasses in FortiMail's IBE webmail feature that can lead to session access and account takeover. Together they give an attacker several routes into a system that sits at the email perimeter, processing messages from untrusted senders all day.

Which versions are affected

The flaws affect FortiMail 8.0.0 to 8.0.1, 7.6.0 to 7.6.6, 7.4.0 to 7.4.8 and all versions of 7.2. The fixed releases are 8.0.2, 7.6.7 and 7.4.9, while FortiMail 7.2 users must move to a supported branch because no fix is planned for it. FortiMail Cloud was remediated by Fortinet on 5 October.

No exploitation reported yet

Fortinet marks none of the advisories as known to be exploited, and none was in CISA's Known Exploited Vulnerabilities catalogue as of 11 November. That is no reason to wait: Fortinet appliances have repeatedly been exploited soon after disclosure. Administrators should patch FortiMail now, keep its management interface off the internet, and check logs for unexpected high-availability join requests, new admin accounts and unfamiliar files. A second independent summary confirms the same advisory numbers, scores and fixed releases.