Field brief
Fortinet FortiMail Path Traversal Vulnerability CVE-2026-126147 Lacks Vendor Advisory, No Patch Yet
A critical path traversal flaw in Fortinet FortiMail remains unpatched, with no vendor advisory or active exploitation reported.
Fortinet’s FortiMail 8.0.0‑8.0.1, 7.6.0‑7.6.6, 7.4.0‑7.4.8, and all 7.2 releases contain a path‑traversal flaw that could let an unauthenticated attacker execute code. The NVD lists CVE‑2026‑126147 with a CVSS score of 9.8, but no vendor advisory or patch has been issued yet. The CVE description notes that the vulnerability could allow unauthorized code execution via crafted requests, yet no active exploitation has been reported and the CISA KEV database shows no listing. Fortinet has not yet released a fixed version, so the affected range remains unchanged. Defenders should keep an eye on Fortinet’s PSIRT portal and apply the forthcoming patch as soon as it becomes available. Until then, monitor FortiMail logs for unusual path traversal attempts. If you manage FortiMail, verify current firmware and apply any available updates promptly. Also, consider tightening path validation in your web server configuration to mitigate potential exploitation.
See what applies to your environment.
Use the Ncerio CVE feed to move from general intelligence to affected products.