FORTIMAIL · CVE-2026-126163 · Infrastructure
FIX → 8.0.2 ✓ verified
A format string flaw in Fortinet FortiMail versions 8.0.0 through 8.0.1 is triggered by a specially crafted SMTP command. A remote attacker with no login may be able to execute unauthorized code or commands on the appliance.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-managed FortiMail appliances or VMs running 8.0.0 or 8.0.1, which accept SMTP from the internet or untrusted networks. A crafted SMTP command triggers a format string flaw and may allow unauthenticated code or command execution. FortiMail Cloud customers, and anyone on 7.6.x or 7.4.x, can skip it.
Not affected if fortimail-cloud, managed-hosting, other-fortimail-versions, version-7.4, version-7.6
Who cares email-gateway, fortimail, fortinet, self-hosted, smtp
get system status on the appliance CLI or check the admin UI dashboard for the firmware version8.0.0 or 8.0.1 (on-premises/self-managed) and SMTP is reachable by untrusted senders. 7.6.x and 7.4.x are not affected per the vendorA use of externally-controlled format string vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1 may allow a remote unauthenticated attacker to execute unauthorized code or commands via a specially crafted SMTP command.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 8.0.2
8.0.2 or later