Check which FortiMail web and quarantine flows each customer exposes. The November hardening batch covers mail release, tenant access and appliance code execution.
Fortinet published these advisories November 10, 2026. Its reviewed advisories mark known exploitation as No, and CISA KEV did not list these CVEs at verification November 11, 2026. Scores below are Fortinet’s CVSS 3.1 values.
What Fortinet disclosed
Critical unauthenticated paths include FG-IR-26-199 / CVE-2026-126147 (9.8, code or command execution), FG-IR-26-200 / CVE-2026-126148 (9.8, code or command execution over reachable HA traffic), and FG-IR-26-216 / CVE-2026-126164 (9.4, SQL injection). The latter’s summary describes code or commands while its impact field says denial of service. Verify exposure without relying on the narrower label.
FG-IR-26-207 / CVE-2026-126155 and FG-IR-26-208 / CVE-2026-126156 are both Critical 9.1. If IBE recipient webmail or account flows are reachable, the first can provide an IBE session and the second can take over an IBE recipient account.
Appliance and cloud fixes
For CVEs 126147, 126155, 126156 and 126164, affected 8.0.0–8.0.1 → 8.0.2+, 7.6.0–7.6.6 → 7.6.7+, 7.4.0–7.4.8 → 7.4.9+, and all 7.2 → migrate to a fixed release. The HA CVE affects the same 8.0 and 7.6 ranges and does not affect 7.4 or 7.2. Fortinet says it remediated these five on FortiMail Cloud October 5 with no customer action.
Suggested MSP priority · urgent where reachable
Inventory appliance versus cloud, firmware, HA peers, reachable interfaces and IBE use. Restrict administration and HA paths to trusted networks where safe. Upgrade and verify each cluster member, mail delivery, HA and IBE functions. Review mail and administrative audit records if exposure or suspicious activity warrants investigation. Fortinet lists no virtual patch for these advisories and gives no blanket credential rotation direction.
What changed · November 11, 2026
Four additional Fortinet advisories published November 10 were verified November 11. Fortinet reports known exploitation as No and lists no virtual patch for these advisories. None appeared in CISA KEV at verification. Scores below are Fortinet’s CVSS v3 base scores.
FG-IR-26-211 · CVE-2026-126159 · High 7.5 and FG-IR-26-212 · CVE-2026-126160 · High 8.2. Reachable quarantine release workflows allow unauthenticated release or deletion of messages for arbitrary mailboxes. For FG-IR-26-204 · CVE-2026-126152 · High 8.1, an authenticated webmail or administrative caller can access or delete calendar and mailbox data across tenant domains or delete directories as root.
For these three CVEs, affected appliance 8.0.0–8.0.1 → 8.0.2+, 7.6.0–7.6.6 → 7.6.7+, 7.4.0–7.4.8 → 7.4.9+, and all 7.2 → migrate. Fortinet says it remediated the two quarantine flaws on FortiMail Cloud October 5. FG-IR-26-204 gives an appliance matrix. Verify cloud applicability separately.
FG-IR-26-277 · CVE-2026-126263 · Critical 9.4. The summary describes authenticated code execution while the attack-type field says unauthenticated and the impact field says privilege escalation. FortiMail 8.0.0–8.0.1 → 8.0.2+, 7.6.0–7.6.4 → 7.6.7+, and 7.4.0–7.4.6 → 7.4.7+. The vendor lists no 7.2 row. Fortinet says FortiMail Cloud was fixed on 7.6.7 or 8.0.2.
Suggested MSP priority. Expedite reachable quarantine and multi-tenant webmail paths. Inventory firmware and interfaces, limit untrusted access where safe, and patch each node. Verify mail delivery, release/delete permissions and tenant isolation. Review unusual release or deletion activity where found.
FG-IR-26-204 · FG-IR-26-211 · FG-IR-26-212 · FG-IR-26-277
Official sources
FG-IR-26-199 · FG-IR-26-200 · FG-IR-26-216 · FG-IR-26-207 · FG-IR-26-208 · Fortinet upgrade path tool · CISA KEV data