CVE-2026-126161: High severity vulnerability
A uncontrolled resource consumption vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.6 may allow a remote unauthenticated attacker to cause a denial of service via repeated unauthenticated POST requests.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FortiMailto a version that resolves this vulnerability.Fixed in 7.4.9 - Upgrade
Upgrade
FortiMailto a version that resolves this vulnerability.Fixed in 7.6.7 - Upgrade
Upgrade
FortiMailto a version that resolves this vulnerability.Fixed in 8.0.2
Event History
Frequently Asked Questions
Which FortiMail versions are affected?
Affected versions are FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, and 7.4.0 through 7.4.6.
Does exploitation require credentials or user interaction?
No. The issue can be exploited remotely by an unauthenticated attacker and does not require user interaction.
What is the likely impact of a successful attack?
A successful attacker may cause a denial of service through uncontrolled resource consumption. The provided severity vector indicates availability impact only, with no stated confidentiality or integrity impact.
What traffic is involved in exploitation?
The vulnerability is triggered through repeated unauthenticated POST requests. Systems reachable by a remote attacker for such requests are the relevant exposure point.