{"id":"CVE-2026-126149","kind":"vulnerability","aliases":["CVE-2026-126149"],"related":[],"title":"Fortinet FortiMail: integer overflow lets an unauthenticated attacker crash the daemon","description":"A integer overflow or wraparound vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow a remote unauthenticated attacker to crash the daemon.","summary":"An integer overflow in several FortiMail email gateway releases can be triggered remotely without logging in. The sources say it lets an attacker crash the mail daemon, which causes a denial of service.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiMail","fixed":["8.0.2","7.6.7","7.4.9"],"affected":">= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.6; >= 7.4.0, <= 7.4.8; 7.2 all; 7.0 all","ecosystem":"vendor"}],"ecosystems":[],"tags":["email-gateway","fortimail","fortinet","infrastructure","self-hosted"],"not_affected_if":["unaffected-version"],"how_to_check":"Run 'get system status' in the FortiMail CLI (or see the system dashboard) and compare the firmware version: affected are 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, and all of 7.2 and 7.0. The vendor does not name a feature or interface that must be enabled, so treat any appliance accepting SMTP from untrusted networks as exposed.","fix":"Upgrade FortiMail 8.0.x to 8.0.2 or above, 7.6.x to 7.6.7 or above, 7.4.x to 7.4.9 or above. FortiMail 7.2 and 7.0 (all versions) have no fix in those branches: migrate to a fixed release.","status":"open","published_at":"2026-11-11T22:17:12+00:00","first_seen_at":"2026-11-11T22:29:27+00:00","triaged_at":"2026-11-11T22:33:09+00:00","updated_at":"2026-11-11T22:48:32+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-11T22:33:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Fortinet FortiMail: integer overflow lets an unauthenticated attacker crash the daemon","impact":"low","summary":"An integer overflow in several FortiMail email gateway releases can be triggered remotely without logging in. The sources say it lets an attacker crash the mail daemon, which causes a denial of service.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortimail","email-gateway","fortinet"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"remote attacker crashes the FortiMail daemon, stopping mail filtering","analyst_note":"Check the Fortinet PSIRT advisory for this CVE for the fixed firmware versions and exposed interfaces; the NVD text gives no fix.","how_to_check":"- Check the FortiMail firmware version under the system dashboard or `get system status` in the CLI against the affected ranges: 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all of 7.2.\n- unknown for any other check, the sources do not say.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"FortiMail appliances or virtual machines in the affected version ranges are exposed to a remote, unauthenticated attacker who can reach the mail service. Sources do not say which interfaces or features must be enabled. Teams on other FortiMail versions or not running FortiMail can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000751,"input_tokens":4589,"output_tokens":585,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Fortinet PSIRT advisory for this CVE for the fixed firmware versions and exposed interfaces; the NVD text gives no fix.","search":"'-126149':14A,17A '-2026':13A,16A '7.2':82C '7.4.0':78C '7.4.8':80C '7.6.0':74C '7.6.6':76C '8.0.0':70C '8.0.1':72C 'allow':86C 'attack':8A,50B,90C 'caus':56B 'crash':9A,51B,92C 'cve':12A,15A 'daemon':11A,54B,94C 'denial':58B 'email':20B,34B 'email-gateway':19B 'fortimail':2A,18A,22B,33B,69C,73C,77C,81C 'fortinet':1A,23B,68C 'gateway':21B,35B 'host':27B 'infrastructur':24B 'integ':3A,29B,62C 'let':5A,48B 'log':42B 'mail':53B 'may':85C 'overflow':4A,30B,63C 'releas':36B 'remot':40B,88C 'say':46B 'self':26B 'self-host':25B 'servic':60B 'sever':32B 'sourc':45B 'trigger':39B 'unauthent':7A,89C 'version':84C 'vulner':66C 'without':41B 'wraparound':65C","nicknames":[],"mitigations":[],"who_affected":"Self-managed FortiMail appliances or VMs on 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, and all 7.2 and 7.0 releases are affected: a remote unauthenticated attacker can crash the smtpd mail daemon, causing denial of service (CVSS 7.5, availability only). Fortinet does not say which features must be enabled. Teams on fixed versions, or not running FortiMail, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:48:32Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-201","run_id":3666},"products":{"at":"2026-11-11T22:48:32Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-201","run_id":3666},"how_to_check":{"at":"2026-11-11T22:48:32Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-201","run_id":3666},"who_affected":{"at":"2026-11-11T22:48:32Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-201","run_id":3666}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["fortimail"],"ptokens":["fortimail"],"labels":["emailgateway","fortimail","fortinet","high","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-126149':14A,17A '-2026':13A,16A 'attack':8A 'crash':9A 'cve':12A,15A 'daemon':11A 'fortimail':2A,18A 'fortinet':1A 'integ':3A 'let':5A 'overflow':4A 'unauthent':7A","search_b":"'attack':50B 'caus':56B 'crash':51B 'daemon':54B 'denial':58B 'email':20B,34B 'email-gateway':19B 'fortimail':22B,33B 'fortinet':23B 'gateway':21B,35B 'host':27B 'infrastructur':24B 'integ':29B 'let':48B 'log':42B 'mail':53B 'overflow':30B 'releas':36B 'remot':40B 'say':46B 'self':26B 'self-host':25B 'servic':60B 'sever':32B 'sourc':45B 'trigger':39B 'without':41B","search_c":"'7.2':82C '7.4.0':78C '7.4.8':80C '7.6.0':74C '7.6.6':76C '8.0.0':70C '8.0.1':72C 'allow':86C 'attack':90C 'crash':92C 'daemon':94C 'fortimail':69C,73C,77C,81C 'fortinet':68C 'integ':62C 'may':85C 'overflow':63C 'remot':88C 'unauthent':89C 'version':84C 'vulner':66C 'wraparound':65C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126149","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126149","severity":null,"published_at":"2026-11-11T22:17:12+00:00","modified_at":"2026-11-11T22:17:12+00:00","first_seen_at":"2026-11-11T22:29:27+00:00","fetched_at":"2026-11-11T22:29:27+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126149:3666","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-201","severity":null,"published_at":"2026-11-11T22:48:32+00:00","modified_at":"2026-11-11T22:48:32+00:00","first_seen_at":"2026-11-11T22:48:32+00:00","fetched_at":"2026-11-11T22:48:32+00:00","note":"Read Fortinet PSIRT FG-IR-26-201: fixed versions 8.0.2, 7.6.7, 7.4.9; 7.2 and 7.0 migrate. Not exploited per vendor, no PoC, no virtual patch. No workaround stated. Interfaces not stated (component listed as smtpd/API).","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-201"]}],"documents":[{"id":129720,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-201","title":"Fortinet PSIRT FG-IR-26-201: Integer overflow or wraparound (FortiMail)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}