CVE-2026-126149 · Infrastructure
NO FIX YET
An integer overflow in several FortiMail email gateway releases can be triggered remotely without logging in. The sources say it lets an attacker crash the mail daemon, which causes a denial of service.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
FortiMail appliances or virtual machines in the affected version ranges are exposed to a remote, unauthenticated attacker who can reach the mail service. Sources do not say which interfaces or features must be enabled. Teams on other FortiMail versions or not running FortiMail can skip it.
Not affected if unaffected-version
Who cares email-gateway, fortimail, fortinet
get system status in the CLI against the affected ranges: 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all of 7.2.No fix yet, per the sources.
A integer overflow or wraparound vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow a remote unauthenticated attacker to crash the daemon.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.