CVE-2026-126154: High severity vulnerability

Published Nov 11, 2026

Updated

A out-of-bounds write vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow a remote unauthenticated attacker to cause a denial of service via a specially crafted HTTP request.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Fortinet FortiMail to a version that resolves this vulnerability.
Fixed in 7.4.9
Upgrade
Upgrade Fortinet FortiMail to a version that resolves this vulnerability.
Fixed in 7.6.7
Upgrade
Upgrade Fortinet FortiMail to a version that resolves this vulnerability.
Fixed in 8.0.2

Event History

Nov 11, 2026

CVE Published

via MITRE·09:29 PM

Data Sourced

via MITRE·09:29 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which FortiMail releases are affected?

Affected releases are FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all FortiMail 7.2 versions.

Does exploitation require authentication or user interaction?

No. A remote attacker can exploit the issue without authentication or user interaction by sending a specially crafted HTTP request.

What is the expected impact of a successful attack?

Successful exploitation may cause a denial of service. The provided assessment indicates no confidentiality or integrity impact.