{"id":"CVE-2026-126165","kind":"vulnerability","aliases":["CVE-2026-126165"],"related":[],"title":"Fortinet FortiMail: crafted SMTP attachment can crash the mail service","description":"A memory allocation with excessive size value vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow a remote unauthenticated attacker to cause a denial of service via a specially crafted attachment delivered over SMTP.","summary":"A memory allocation flaw in Fortinet FortiMail lets a remote, unauthenticated sender crash the mail service with a specially crafted attachment delivered over SMTP. The result is a denial of service, not code execution, according to the description.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["email-gateway","fortimail","fortinet","infrastructure","smtp"],"not_affected_if":["version-outside-affected-ranges"],"how_to_check":"- Check the FortiMail firmware version under the admin console's system information page; compare it with the affected ranges below.\n- Confirm whether the SMTP service is reachable from the internet.","fix":"- FortiMail `8.0.0` through `8.0.1`, `7.6.0` through `7.6.6`, `7.4.0` through `7.4.8`, and all `7.2` versions are affected; the sources do not name the fixed version.","status":"open","published_at":"2026-11-11T22:17:14+00:00","first_seen_at":"2026-11-11T22:29:29+00:00","triaged_at":"2026-11-11T22:32:06+00:00","updated_at":"2026-11-11T22:32:06+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-11T22:32:06Z","model":"claude-haiku-5-5","output":{"fix":"- FortiMail `8.0.0` through `8.0.1`, `7.6.0` through `7.6.6`, `7.4.0` through `7.4.8`, and all `7.2` versions are affected; the sources do not name the fixed version.","reach":"internet","title":"Fortinet FortiMail: crafted SMTP attachment can crash the mail service","impact":"low","summary":"A memory allocation flaw in Fortinet FortiMail lets a remote, unauthenticated sender crash the mail service with a specially crafted attachment delivered over SMTP. The result is a denial of service, not code execution, according to the description.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortimail","email-gateway","smtp","fortinet"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Mail service crashes, halting email delivery until restarted","analyst_note":"Find the vendor advisory and the fixed FortiMail versions for this CVE; the NVD entry alone does not give a fix.","how_to_check":"- Check the FortiMail firmware version under the admin console's system information page; compare it with the affected ranges below.\n- Confirm whether the SMTP service is reachable from the internet.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-outside-affected-ranges"],"who_is_affected":"Organizations running Fortinet FortiMail email security appliances in the affected version ranges, especially those with SMTP reachable from outside. Sites running other mail products or versions outside these ranges are not named in the sources.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000763,"input_tokens":4602,"output_tokens":606,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126165':13A,16A '-2026':12A,15A '7.2':85C '7.4.0':81C '7.4.8':83C '7.6.0':77C '7.6.6':79C '8.0.0':73C '8.0.1':75C 'accord':58B 'alloc':26B,64C 'allow':89C 'attach':5A,44B,104C 'attack':93C 'caus':95C 'code':56B 'craft':3A,43B,103C 'crash':7A,36B 'cve':11A,14A 'deliv':45B,105C 'denial':52B,97C 'descript':61B 'email':18B 'email-gateway':17B 'excess':66C 'execut':57B 'flaw':27B 'fortimail':2A,20B,30B,72C,76C,80C,84C 'fortinet':1A,21B,29B,71C 'gateway':19B 'infrastructur':22B 'let':31B 'mail':9A,38B 'may':88C 'memori':25B,63C 'remot':33B,91C 'result':49B 'sender':35B 'servic':10A,39B,54B,99C 'size':67C 'smtp':4A,23B,47B,107C 'special':42B,102C 'unauthent':34B,92C 'valu':68C 'version':87C 'via':100C 'vulner':69C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Fortinet FortiMail email security appliances in the affected version ranges, especially those with SMTP reachable from outside. Sites running other mail products or versions outside these ranges are not named in the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["emailgateway","fortimail","fortinet","high","infrastructure","smtp"],"campaign_type":null,"search_a":"'-126165':13A,16A '-2026':12A,15A 'attach':5A 'craft':3A 'crash':7A 'cve':11A,14A 'fortimail':2A 'fortinet':1A 'mail':9A 'servic':10A 'smtp':4A","search_b":"'accord':58B 'alloc':26B 'attach':44B 'code':56B 'craft':43B 'crash':36B 'deliv':45B 'denial':52B 'descript':61B 'email':18B 'email-gateway':17B 'execut':57B 'flaw':27B 'fortimail':20B,30B 'fortinet':21B,29B 'gateway':19B 'infrastructur':22B 'let':31B 'mail':38B 'memori':25B 'remot':33B 'result':49B 'sender':35B 'servic':39B,54B 'smtp':23B,47B 'special':42B 'unauthent':34B","search_c":"'7.2':85C '7.4.0':81C '7.4.8':83C '7.6.0':77C '7.6.6':79C '8.0.0':73C '8.0.1':75C 'alloc':64C 'allow':89C 'attach':104C 'attack':93C 'caus':95C 'craft':103C 'deliv':105C 'denial':97C 'excess':66C 'fortimail':72C,76C,80C,84C 'fortinet':71C 'may':88C 'memori':63C 'remot':91C 'servic':99C 'size':67C 'smtp':107C 'special':102C 'unauthent':92C 'valu':68C 'version':87C 'via':100C 'vulner':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126165","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126165","severity":null,"published_at":"2026-11-11T22:17:14+00:00","modified_at":"2026-11-11T22:17:14+00:00","first_seen_at":"2026-11-11T22:29:29+00:00","fetched_at":"2026-11-11T22:29:29+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}