FortiMail, FortiOS and FortiManager get fixes for critical flaws that need no login (CVE-2026-126147)

12 November 2026Critical 9.8

Fortinet · FortiMail, FortiOS, FortiSASE and FortiManager · CVE-2026-126147

FortiMail, FortiOS and FortiManager get fixes for critical flaws that need no login

Fortinet's 10 November advisories include several critical flaws that can be used without logging in. The most severe, CVE-2026-126147 (CVSS 9.8), is a path traversal flaw in FortiMail that lets a remote attacker run code or commands with crafted requests. Two others stand out: CVE-2026-126253 (9.3) lets an attacker send forged routing announcements to the OSPF service in FortiOS and FortiSASE, and CVE-2026-126261 (9.0) allows code execution on FortiManager by anyone who can reach its FGFM port. Fortinet lists none of the three as exploited.

Affected: FortiMail 8.0.0 to 8.0.1, 7.6.0 to 7.6.6, 7.4.0 to 7.4.8 and all 7.2 versions (CVE-2026-126147). FortiOS 8.0.0 to 8.0.1, 7.6.0 to 7.6.7, 7.4.0 to 7.4.12, 7.2.0 to 7.2.13 and 7.0.1 to 7.0.19, plus FortiSASE 25.1 to 26.3.1 (CVE-2026-126253). FortiManager 8.0.0, 7.6.0 to 7.6.7, 7.4.0 to 7.4.5 and 7.2.0 to 7.2.8 (CVE-2026-126261). Fortinet says FortiMail Cloud has already been remediated.
What to do: Upgrade FortiMail to 8.0.2, 7.6.7 or 7.4.9 or later (7.2 must migrate to a fixed release). Upgrade FortiOS to 8.0.2, 7.6.8, 7.4.13 or 7.2.14 or later (7.0 must migrate to a fixed release). Upgrade FortiManager to 8.0.1, 7.6.8, 7.4.6 or 7.2.9 or later. Fortinet lists no workarounds for these three, and FortiMail Cloud customers need do nothing. Fortinet published many other advisories the same day, so check its PSIRT list for every Fortinet product you run.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.
Why it’s here: Critical, no login needed, in firewalls and email gateways that many small businesses and their IT providers run.

FortiMail, FortiOS and FortiManager get fixes for critical flaws that need no login

Affected

FortiMail 8.0.0 to 8.0.1, 7.6.0 to 7.6.6, 7.4.0 to 7.4.8 and all 7.2 versions (CVE-2026-126147). FortiOS 8.0.0 to 8.0.1, 7.6.0 to 7.6.7, 7.4.0 to 7.4.12, 7.2.0 to 7.2.13 and 7.0.1 to 7.0.19, plus FortiSASE 25.1 to 26.3.1 (CVE-2026-126253). FortiManager 8.0.0, 7.6.0 to 7.6.7, 7.4.0 to 7.4.5 and 7.2.0 to 7.2.8 (CVE-2026-126261). Fortinet says FortiMail Cloud has already been remediated.

What to do

Upgrade FortiMail to 8.0.2, 7.6.7 or 7.4.9 or later (7.2 must migrate to a fixed release). Upgrade FortiOS to 8.0.2, 7.6.8, 7.4.13 or 7.2.14 or later (7.0 must migrate to a fixed release). Upgrade FortiManager to 8.0.1, 7.6.8, 7.4.6 or 7.2.9 or later. Fortinet lists no workarounds for these three, and FortiMail Cloud customers need do nothing. Fortinet published many other advisories the same day, so check its PSIRT list for every Fortinet product you run.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.

Why it’s here

Critical, no login needed, in firewalls and email gateways that many small businesses and their IT providers run.