{"id":"CVE-2026-126163","kind":"vulnerability","aliases":["CVE-2026-126163"],"related":[],"title":"Fortinet FortiMail: crafted SMTP command lets unauthenticated attackers run code","description":"A use of externally-controlled format string vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1 may allow a remote unauthenticated attacker to execute unauthorized code or commands via a specially crafted SMTP command.","summary":"A format string flaw in Fortinet FortiMail versions 8.0.0 through 8.0.1 is triggered by a specially crafted SMTP command. A remote attacker with no login may be able to execute unauthorized code or commands on the appliance.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiMail","fixed":["8.0.2"],"affected":">= 8.0.0, < 8.0.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["email-gateway","fortimail","fortinet","infrastructure","self-hosted","smtp"],"not_affected_if":["fortimail-cloud","managed-hosting","other-fortimail-versions","version-7.4","version-7.6"],"how_to_check":"Run 'get system status' on the appliance CLI or check the admin UI dashboard for the firmware version. Exposed if it is 8.0.0 or 8.0.1 (on-premises/self-managed) and SMTP is reachable by untrusted senders. 7.6.x and 7.4.x are not affected per the vendor. No virtual patch (IPS signature) is available per Fortinet.","fix":"Upgrade FortiMail 8.0.x to 8.0.2 or later. FortiMail 7.6 and 7.4 are not affected. FortiMail Cloud was already updated by Fortinet on Oct 5, 2026.","status":"open","published_at":"2026-11-11T22:17:14+00:00","first_seen_at":"2026-11-11T22:29:28+00:00","triaged_at":"2026-11-11T22:31:49+00:00","updated_at":"2026-11-11T22:47:30+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-11-11T22:31:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Fortinet FortiMail: crafted SMTP command lets unauthenticated attackers run code","impact":"high","summary":"A format string flaw in Fortinet FortiMail versions 8.0.0 through 8.0.1 is triggered by a specially crafted SMTP command. A remote attacker with no login may be able to execute unauthorized code or commands on the appliance.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortimail","email-gateway","fortinet"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"remote attacker runs unauthorized code on the mail appliance","analyst_note":"Confirm the fixed FortiMail version and any vendor advisory (Fortinet PSIRT) for the 8.0.x range; the NVD entry gives no fix.","how_to_check":"- Check the FortiMail version under the admin interface or with `get system status` on the appliance, and see whether it falls in 8.0.0 to 8.0.1.\n- unknown for anything beyond the version range, since the sources do not say.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-fortimail-versions"],"who_is_affected":"FortiMail appliances on the 8.0.0 to 8.0.1 line are the affected systems, and the SMTP service is the reachable path. Organizations running other FortiMail versions are outside the stated range. The sources do not describe any extra configuration needed to be exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000738,"input_tokens":4544,"output_tokens":568,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed FortiMail version and any vendor advisory (Fortinet PSIRT) for the 8.0.x range; the NVD entry gives no fix.","search":"'-126163':13A,16A '-2026':12A,15A '8.0.0':36B,77C '8.0.1':38B,79C 'abl':55B 'allow':81C 'applianc':64B 'attack':8A,49B,85C 'code':10A,59B,89C 'command':5A,46B,61B,91C,97C 'control':70C 'craft':3A,44B,95C 'cve':11A,14A 'email':19B 'email-gateway':18B 'execut':57B,87C 'extern':69C 'externally-control':68C 'flaw':31B 'format':29B,71C 'fortimail':2A,17A,21B,34B,76C 'fortinet':1A,22B,33B,75C 'gateway':20B 'host':26B 'infrastructur':23B 'let':6A 'login':52B 'may':53B,80C 'remot':48B,83C 'run':9A 'self':25B 'self-host':24B 'smtp':4A,27B,45B,96C 'special':43B,94C 'string':30B,72C 'trigger':40B 'unauthent':7A,84C 'unauthor':58B,88C 'use':66C 'version':35B 'via':92C 'vulner':73C","nicknames":[],"mitigations":[],"who_affected":"Self-managed FortiMail appliances or VMs running 8.0.0 or 8.0.1, which accept SMTP from the internet or untrusted networks. A crafted SMTP command triggers a format string flaw and may allow unauthenticated code or command execution. FortiMail Cloud customers, and anyone on 7.6.x or 7.4.x, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:47:30Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-215","run_id":3661},"products":{"at":"2026-11-11T22:47:30Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-215","run_id":3661},"how_to_check":{"at":"2026-11-11T22:47:30Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-215","run_id":3661},"who_affected":{"at":"2026-11-11T22:47:30Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-215","run_id":3661}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["fortimail"],"ptokens":["fortimail"],"labels":["emailgateway","fortimail","fortinet","high","infrastructure","selfhosted","smtp"],"campaign_type":null,"search_a":"'-126163':13A,16A '-2026':12A,15A 'attack':8A 'code':10A 'command':5A 'craft':3A 'cve':11A,14A 'fortimail':2A,17A 'fortinet':1A 'let':6A 'run':9A 'smtp':4A 'unauthent':7A","search_b":"'8.0.0':36B '8.0.1':38B 'abl':55B 'applianc':64B 'attack':49B 'code':59B 'command':46B,61B 'craft':44B 'email':19B 'email-gateway':18B 'execut':57B 'flaw':31B 'format':29B 'fortimail':21B,34B 'fortinet':22B,33B 'gateway':20B 'host':26B 'infrastructur':23B 'login':52B 'may':53B 'remot':48B 'self':25B 'self-host':24B 'smtp':27B,45B 'special':43B 'string':30B 'trigger':40B 'unauthor':58B 'version':35B","search_c":"'8.0.0':77C '8.0.1':79C 'allow':81C 'attack':85C 'code':89C 'command':91C,97C 'control':70C 'craft':95C 'execut':87C 'extern':69C 'externally-control':68C 'format':71C 'fortimail':76C 'fortinet':75C 'may':80C 'remot':83C 'smtp':96C 'special':94C 'string':72C 'unauthent':84C 'unauthor':88C 'use':66C 'via':92C 'vulner':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126163","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126163","severity":null,"published_at":"2026-11-11T22:17:14+00:00","modified_at":"2026-11-11T22:17:14+00:00","first_seen_at":"2026-11-11T22:29:28+00:00","fetched_at":"2026-11-11T22:29:28+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126163:3661","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-215","severity":null,"published_at":"2026-11-11T22:47:30+00:00","modified_at":"2026-11-11T22:47:30+00:00","first_seen_at":"2026-11-11T22:47:30+00:00","fetched_at":"2026-11-11T22:47:30+00:00","note":"Fortinet PSIRT FG-IR-26-215 read: affects 8.0.0-8.0.1, fixed 8.0.2; 7.6/7.4 not affected; FortiMail Cloud already patched Oct 5 2026; not exploited per vendor. X/community not searched (low-signal B).","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-215"]}],"documents":[{"id":129718,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-215","title":"Fortinet PSIRT FG-IR-26-215: FortiMail format string (CVE-2026-126163)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}