CVE-2026-126163: High severity vulnerability
A use of externally-controlled format string vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1 may allow a remote unauthenticated attacker to execute unauthorized code or commands via a specially crafted SMTP command.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fortinet FortiMailto a version that resolves this vulnerability.Fixed in 8.0.2
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
A remote, unauthenticated attacker may exploit it by sending a specially crafted SMTP command. No prior account or user interaction is required.
Which FortiMail versions are affected?
FortiMail versions 8.0.0 through 8.0.1 are identified as affected.
What impact could successful exploitation have?
Successful exploitation may allow unauthorized code or command execution. The reported impact includes high confidentiality, integrity, and availability effects.
Does exploitation require a straightforward attack?
No. The supplied vector rates attack complexity as high, indicating exploitation requires conditions or techniques beyond simply reaching the SMTP service.