gcdRadar
live/Patch now/AIR-2026-1869
livelivePatch now2 Disclosed vulnerability

Fortinet FortiMail Incorrect Authorization Vulnerability

FortiMail

An incorrect authorization flaw in FortiMail allows unauthenticated remote attackers to hijack IBE webmail sessions and access encrypted emails. Fortinet disclosed the vulnerability with a CVSS score of 9.1.

why this severityRated critical with a CVSS score of 9.1.

CVSS
9.1
fix status
Fix status unknown
first report
10 Nov 2026
last update
10 Nov 2026

What to do

Check Fortinet advisory for patch availability and apply updates.

Timeline · 2

  1. 10 Nov 2026Incorrect authorization
  2. 10 Nov 2026Incorrect authorization

Sources · 2

Advisories and databases

  1. 2026-11-10
    Incorrect authorization
    Fortinet · fortiguard.fortinet.com/psirt/FG-IR-26-207
  2. 2026-11-10
    Incorrect authorization
    Fortinet · fortiguard.fortinet.com/psirt/FG-IR-26-265

Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.

Classification

lane
Patch now
AI role
No AI role
categories
General security
severity
2 · Disclosed vulnerability
fix status
Fix status unknown
targets
Not applicable
owasp llm top 10
no entry for these categories
mitre atlas
no technique for these categories
tags
cwe-863fortinetfortimailauthorization
dates
happened 10 Nov 2026 · first reported 10 Nov 2026
origin
News & research feeds
record
confidence 0.95 · created 2026-11-10 20:42Z · updated 2026-11-10 20:42Z

Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned

Copy a brief

This record as a short Markdown brief, for a ticket, a chat or a coding agent.

the brief as text
# Fortinet FortiMail Incorrect Authorization Vulnerability

https://gcdradar.vercel.app/incidents/fortinet-fortimail-incorrect-authorization-vulnerability · AIR-2026-1869 · live

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability): Rated critical with a CVSS score of 9.1.
- Fix status: Fix status unknown
- First reported: 2026-11-10
- AI role: No AI role
- Products: FortiMail
- CVSS: 9.1

## Summary

An incorrect authorization flaw in FortiMail allows unauthenticated remote attackers to hijack IBE webmail sessions and access encrypted emails. Fortinet disclosed the vulnerability with a CVSS score of 9.1.

## What to do

Check Fortinet advisory for patch availability and apply updates.

## Latest updates

- 2026-11-10: Incorrect authorization (https://fortiguard.fortinet.com/psirt/FG-IR-26-265)
- 2026-11-10: Incorrect authorization (https://fortiguard.fortinet.com/psirt/FG-IR-26-207)

## Sources

- 2026-11-10 Fortinet: Incorrect authorization https://fortiguard.fortinet.com/psirt/FG-IR-26-207
- 2026-11-10 Fortinet: Incorrect authorization https://fortiguard.fortinet.com/psirt/FG-IR-26-265

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.

Related

  1. live9.8
    FortiMail FortiMail path traversal enables unauthorized code execution

    Patch now · Disclosed · since 10 Nov 2026

  2. live9.8
    FortiMail FortiMail command injection allows unauthenticated code execution

    Patch now · Disclosed · since 10 Nov 2026

  3. closed
    FortiOS Fortinet patches critical FortiOS flaws found with AI help

    Patch now · Disclosed · Patched · since 26 Oct 2026

  4. live
    Dixell refrigeration units Multiple vulnerabilities discovered in Dixell refrigeration units

    Patch now · Exploited · since 13 Nov 2026

  5. live8.6
    UnrealIRCd CVE-2026-114713: UnrealIRCd improper neutralization of delimiters vulnerability

    Patch now · Exploited · Partly patched · since 13 Nov 2026 · CVE-2026-114713

  6. live
    City of Osaka municipal systems City of Osaka suffers data breach impacting one million residents

    Breaches & attacks · Real loss · since 13 Nov 2026