---
id: "CVE-2026-126149"
page: "https://infrastack.ai/live/CVE-2026-126149"
kind: "vulnerability"
aliases: ["CVE-2026-126149"]
title: "Fortinet FortiMail: integer overflow lets an unauthenticated attacker crash the daemon"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "FortiMail", "fixed": ["8.0.2", "7.6.7", "7.4.9"], "affected": ">= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.6; >= 7.4.0, <= 7.4.8; 7.2 all; 7.0 all", "ecosystem": "vendor"}]
ecosystems: []
tags: ["email-gateway", "fortimail", "fortinet", "infrastructure", "self-hosted"]
not_affected_if: ["unaffected-version"]
published_at: "2026-11-11T22:17:12+00:00"
first_seen_at: "2026-11-11T22:29:27+00:00"
updated_at: "2026-11-11T22:48:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126149", "first_seen_at": "2026-11-11T22:29:27+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-201", "first_seen_at": "2026-11-11T22:48:32+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-201"]}]
exploit_sources: []
---

# Fortinet FortiMail: integer overflow lets an unauthenticated attacker crash the daemon

Link for people: https://infrastack.ai/live/CVE-2026-126149 (this .md is for agents)

An integer overflow in several FortiMail email gateway releases can be triggered remotely without logging in. The sources say it lets an attacker crash the mail daemon, which causes a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiMail affected >= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.6; >= 7.4.0, <= 7.4.8; 7.2 all; 7.0 all fixed 8.0.2, 7.6.7, 7.4.9

## How to check

Run 'get system status' in the FortiMail CLI (or see the system dashboard) and compare the firmware version: affected are 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, and all of 7.2 and 7.0. The vendor does not name a feature or interface that must be enabled, so treat any appliance accepting SMTP from untrusted networks as exposed.

## Fix

Upgrade FortiMail 8.0.x to 8.0.2 or above, 7.6.x to 7.6.7 or above, 7.4.x to 7.4.9 or above. FortiMail 7.2 and 7.0 (all versions) have no fix in those branches: migrate to a fixed release.

## Timeline

- 2026-11-11T22:29:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126149
- 2026-11-11T22:48:32+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-201 — Read Fortinet PSIRT FG-IR-26-201: fixed versions 8.0.2, 7.6.7, 7.4.9; 7.2 and 7.0 migrate. Not exploited per vendor, no PoC, no virtual patch. No workaround stated. Interfaces not stated (component listed as smtpd/API).

## Documents

- [advisory] Fortinet PSIRT FG-IR-26-201: Integer overflow or wraparound (FortiMail) https://fortiguard.fortinet.com/psirt/FG-IR-26-201

## From the sources

A integer overflow or wraparound vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow a remote unauthenticated attacker to crash the daemon.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_