{"id":"CVE-2026-126161","kind":"vulnerability","aliases":["CVE-2026-126161"],"related":[],"title":"Fortinet FortiMail: unauthenticated requests can exhaust resources and cause denial of service","description":"A uncontrolled resource consumption vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.6 may allow a remote unauthenticated attacker to cause a denial of service via repeated unauthenticated POST requests.","summary":"FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6 and 7.4.0 through 7.4.6 have an uncontrolled resource consumption flaw. A remote attacker without credentials can send repeated unauthenticated POST requests to make the service unavailable.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["email-security","fortimail","fortinet","vendor"],"not_affected_if":["unaffected-version"],"how_to_check":"- Check the installed FortiMail version in the admin console and compare it with the affected ranges: `8.0.0` to `8.0.1`, `7.6.0` to `7.6.6`, `7.4.0` to `7.4.6`.","fix":"- Fixed versions are not stated in the sources; check the Fortinet advisory for the fixed release of each affected branch.","status":"open","published_at":"2026-11-11T22:17:14+00:00","first_seen_at":"2026-11-11T22:29:28+00:00","triaged_at":"2026-11-11T22:32:08+00:00","updated_at":"2026-11-11T22:32:08+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-11T22:32:08Z","model":"claude-haiku-5-5","output":{"fix":"- Fixed versions are not stated in the sources; check the Fortinet advisory for the fixed release of each affected branch.","reach":"internet","title":"Fortinet FortiMail: unauthenticated requests can exhaust resources and cause denial of service","impact":"low","summary":"FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6 and 7.4.0 through 7.4.6 have an uncontrolled resource consumption flaw. A remote attacker without credentials can send repeated unauthenticated POST requests to make the service unavailable.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortimail","email-security","fortinet"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Mail gateway becomes unavailable, stopping email filtering and delivery.","analyst_note":"Find the Fortinet PSIRT advisory for CVE-2026-126161 to confirm fixed versions for 8.0, 7.6 and 7.4 branches and any workaround.","how_to_check":"- Check the installed FortiMail version in the admin console and compare it with the affected ranges: `8.0.0` to `8.0.1`, `7.6.0` to `7.6.6`, `7.4.0` to `7.4.6`.\n- unknown for other checks: the sources do not say which settings or logs show the attack.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"FortiMail appliances or virtual machines in the affected version ranges that are reachable from the internet or from untrusted networks. Deployments on unaffected versions can skip it. The sources do not say whether specific configurations change exposure.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000792,"input_tokens":4593,"output_tokens":665,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126161':15A,18A '-2026':14A,17A '7.4.0':33B,74C '7.4.6':35B,76C '7.6.0':29B,70C '7.6.6':31B,72C '8.0.0':26B,66C '8.0.1':28B,68C 'allow':78C 'attack':44B,82C 'caus':9A,84C 'consumpt':40B,61C 'credenti':46B 'cve':13A,16A 'denial':10A,86C 'email':20B 'email-secur':19B 'exhaust':6A 'flaw':41B 'fortimail':2A,22B,25B,65C,69C,73C 'fortinet':1A,23B,64C 'make':54B 'may':77C 'post':51B,92C 'remot':43B,80C 'repeat':49B,90C 'request':4A,52B,93C 'resourc':7A,39B,60C 'secur':21B 'send':48B 'servic':12A,56B,88C 'unauthent':3A,50B,81C,91C 'unavail':57B 'uncontrol':38B,59C 'vendor':24B 'via':89C 'vulner':62C 'without':45B","nicknames":[],"mitigations":[],"who_affected":"FortiMail appliances or virtual machines in the affected version ranges that are reachable from the internet or from untrusted networks. Deployments on unaffected versions can skip it. The sources do not say whether specific configurations change exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["emailsecurity","fortimail","fortinet","high","vendor"],"campaign_type":null,"search_a":"'-126161':15A,18A '-2026':14A,17A 'caus':9A 'cve':13A,16A 'denial':10A 'exhaust':6A 'fortimail':2A 'fortinet':1A 'request':4A 'resourc':7A 'servic':12A 'unauthent':3A","search_b":"'7.4.0':33B '7.4.6':35B '7.6.0':29B '7.6.6':31B '8.0.0':26B '8.0.1':28B 'attack':44B 'consumpt':40B 'credenti':46B 'email':20B 'email-secur':19B 'flaw':41B 'fortimail':22B,25B 'fortinet':23B 'make':54B 'post':51B 'remot':43B 'repeat':49B 'request':52B 'resourc':39B 'secur':21B 'send':48B 'servic':56B 'unauthent':50B 'unavail':57B 'uncontrol':38B 'vendor':24B 'without':45B","search_c":"'7.4.0':74C '7.4.6':76C '7.6.0':70C '7.6.6':72C '8.0.0':66C '8.0.1':68C 'allow':78C 'attack':82C 'caus':84C 'consumpt':61C 'denial':86C 'fortimail':65C,69C,73C 'fortinet':64C 'may':77C 'post':92C 'remot':80C 'repeat':90C 'request':93C 'resourc':60C 'servic':88C 'unauthent':81C,91C 'uncontrol':59C 'via':89C 'vulner':62C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126161","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126161","severity":null,"published_at":"2026-11-11T22:17:14+00:00","modified_at":"2026-11-11T22:17:14+00:00","first_seen_at":"2026-11-11T22:29:28+00:00","fetched_at":"2026-11-11T22:29:28+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}