CVE-2026-126154 · Vendor
NO FIX YET
An out-of-bounds write in several FortiMail releases lets a remote, unauthenticated attacker send a specially crafted HTTP request. The result is a denial of service, meaning the mail appliance stops working.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations running the listed FortiMail versions with the web or HTTP interface reachable by an attacker. The sources do not say whether the flaw needs a particular setting, so exposure of the HTTP interface is the main factor. Teams on other FortiMail releases or with the interface fully restricted can likely skip it.
Not affected if other-fortimail-versions
Who cares email-gateway, fortimail, fortinet
get system status in the CLI.No fix yet, per the sources.
A out-of-bounds write vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow a remote unauthenticated attacker to cause a denial of service via a specially crafted HTTP request.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.