{"id":"CVE-2026-126154","kind":"vulnerability","aliases":["CVE-2026-126154"],"related":[],"title":"Fortinet FortiMail: crafted HTTP request can crash the mail appliance","description":"A out-of-bounds write vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow a remote unauthenticated attacker to cause a denial of service via a specially crafted HTTP request.","summary":"An out-of-bounds write in several FortiMail releases lets a remote, unauthenticated attacker send a specially crafted HTTP request. The result is a denial of service, meaning the mail appliance stops working.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiMail","fixed":["8.0.2","7.6.7","7.4.9"],"affected":">= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.6; >= 7.4.0, <= 7.4.8; 7.2 all versions","ecosystem":"vendor"}],"ecosystems":[],"tags":["email-gateway","fortimail","fortinet","self-hosted","vendor"],"not_affected_if":["fortimail-cloud","managed-hosting","other-fortimail-versions"],"how_to_check":"- Check the FortiMail version under the admin dashboard or with `get system status` in the CLI.\n- Compare the version against the affected ranges: 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all 7.2 releases.","fix":"Upgrade FortiMail 8.0.x to 8.0.2 or above, 7.6.x to 7.6.7 or above, 7.4.x to 7.4.9 or above. FortiMail 7.2 (all versions) has no fix in its branch: migrate to a fixed release.","status":"open","published_at":"2026-11-11T22:17:13+00:00","first_seen_at":"2026-11-11T22:29:28+00:00","triaged_at":"2026-11-11T22:33:06+00:00","updated_at":"2026-11-11T22:48:46+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-11-11T22:33:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Fortinet FortiMail: crafted HTTP request can crash the mail appliance","impact":"low","summary":"An out-of-bounds write in several FortiMail releases lets a remote, unauthenticated attacker send a specially crafted HTTP request. The result is a denial of service, meaning the mail appliance stops working.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortimail","fortinet","email-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker crashes the FortiMail appliance, stopping mail service","analyst_note":"Confirm the fixed versions and any workaround in the Fortinet PSIRT advisory for this CVE, since the sources give no fix.","how_to_check":"- Check the FortiMail version under the admin dashboard or with `get system status` in the CLI.\n- Compare the version against the affected ranges: 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all 7.2 releases.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-fortimail-versions"],"who_is_affected":"Organizations running the listed FortiMail versions with the web or HTTP interface reachable by an attacker. The sources do not say whether the flaw needs a particular setting, so exposure of the HTTP interface is the main factor. Teams on other FortiMail releases or with the interface fully restricted can likely skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000751,"input_tokens":4605,"output_tokens":580,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed versions and any workaround in the Fortinet PSIRT advisory for this CVE, since the sources give no fix.","search":"'-126154':13A,16A '-2026':12A,15A '7.2':83C '7.4.0':79C '7.4.8':81C '7.6.0':75C '7.6.6':77C '8.0.0':71C '8.0.1':73C 'allow':87C 'applianc':10A,58B 'attack':41B,91C 'bound':31B,65C 'caus':93C 'craft':3A,45B,101C 'crash':7A 'cve':11A,14A 'denial':52B,95C 'email':19B 'email-gateway':18B 'fortimail':2A,17A,21B,35B,70C,74C,78C,82C 'fortinet':1A,22B,69C 'gateway':20B 'host':25B 'http':4A,46B,102C 'let':37B 'mail':9A,57B 'may':86C 'mean':55B 'out-of-bound':28B,62C 'releas':36B 'remot':39B,89C 'request':5A,47B,103C 'result':49B 'self':24B 'self-host':23B 'send':42B 'servic':54B,97C 'sever':34B 'special':44B,100C 'stop':59B 'unauthent':40B,90C 'vendor':26B 'version':85C 'via':98C 'vulner':67C 'work':60B 'write':32B,66C","nicknames":[],"mitigations":[],"who_affected":"Self-managed FortiMail appliances and VMs on 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8 or any 7.2 release are affected. An unauthenticated remote attacker who can reach the HTTP interface can crash the appliance with a crafted request, which stops mail handling. FortiMail Cloud customers can skip it: Fortinet updated those to 7.6.7 or 8.0.2 on Oct 05 2026.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:48:46Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-206","run_id":3663},"products":{"at":"2026-11-11T22:48:46Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-206","run_id":3663},"who_affected":{"at":"2026-11-11T22:48:46Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-206","run_id":3663}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["fortimail"],"ptokens":["fortimail"],"labels":["emailgateway","fortimail","fortinet","high","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126154':13A,16A '-2026':12A,15A 'applianc':10A 'craft':3A 'crash':7A 'cve':11A,14A 'fortimail':2A,17A 'fortinet':1A 'http':4A 'mail':9A 'request':5A","search_b":"'applianc':58B 'attack':41B 'bound':31B 'craft':45B 'denial':52B 'email':19B 'email-gateway':18B 'fortimail':21B,35B 'fortinet':22B 'gateway':20B 'host':25B 'http':46B 'let':37B 'mail':57B 'mean':55B 'out-of-bound':28B 'releas':36B 'remot':39B 'request':47B 'result':49B 'self':24B 'self-host':23B 'send':42B 'servic':54B 'sever':34B 'special':44B 'stop':59B 'unauthent':40B 'vendor':26B 'work':60B 'write':32B","search_c":"'7.2':83C '7.4.0':79C '7.4.8':81C '7.6.0':75C '7.6.6':77C '8.0.0':71C '8.0.1':73C 'allow':87C 'attack':91C 'bound':65C 'caus':93C 'craft':101C 'denial':95C 'fortimail':70C,74C,78C,82C 'fortinet':69C 'http':102C 'may':86C 'out-of-bound':62C 'remot':89C 'request':103C 'servic':97C 'special':100C 'unauthent':90C 'version':85C 'via':98C 'vulner':67C 'write':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126154","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126154","severity":null,"published_at":"2026-11-11T22:17:13+00:00","modified_at":"2026-11-11T22:17:13+00:00","first_seen_at":"2026-11-11T22:29:28+00:00","fetched_at":"2026-11-11T22:29:28+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126154:3663","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-206","severity":null,"published_at":"2026-11-11T22:48:46+00:00","modified_at":"2026-11-11T22:48:46+00:00","first_seen_at":"2026-11-11T22:48:46+00:00","fetched_at":"2026-11-11T22:48:46+00:00","note":"Read Fortinet FG-IR-26-206 (published 2026-11-10): affected and fixed versions confirmed; FortiMail Cloud already patched Oct 05 2026; no workaround or virtual patch listed. Exploitation status not read on the page, left false.","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-206","https://nvd.nist.gov/vuln/detail/CVE-2026-126154"]}],"documents":[{"id":129722,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-206","title":"FG-IR-26-206 Out-of-bounds write (FortiMail)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":129723,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126154","title":"NVD CVE-2026-126154","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}