CVE-2026-126149: Integer Overflow

Published Nov 11, 2026

Updated

A integer overflow or wraparound vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow a remote unauthenticated attacker to crash the daemon.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Fortinet FortiMail to a version that resolves this vulnerability.
Fixed in 7.4.9
Upgrade
Upgrade Fortinet FortiMail to a version that resolves this vulnerability.
Fixed in 7.6.7
Upgrade
Upgrade Fortinet FortiMail to a version that resolves this vulnerability.
Fixed in 8.0.2

Event History

Nov 11, 2026

CVE Published

via MITRE·09:29 PM

Data Sourced

via MITRE·09:29 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which FortiMail deployments are affected?

Affected versions are FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all FortiMail 7.2 versions.

Does an attacker need credentials or user interaction to trigger the issue?

No. The vulnerability may be exploited remotely by an unauthenticated attacker, and no user interaction is required.

What is the expected impact of successful exploitation?

Successful exploitation may crash the affected daemon, resulting in an availability impact. The provided information does not identify confidentiality or integrity impact.