Fortinet FortiMail: Uncontrolled resource consumption (CVE-2026-126161)
An uncontrolled resource consumption vulnerability in Fortinet FortiMail allows remote, unauthenticated attackers to trigger a denial of service condition by sending repeated malicious POST requests to the device.
CVE search metadata
CVE search record: CVE-2026-126161. Severity: high. CVSS: 7.5. KEV: no. Product: FortiMail (8.0.0 through 8.0.1), FortiMail (7.6.0 through 7.6.6), FortiMail (7.4.0 through 7.4.6). Brief: Fortinet FortiMail: Uncontrolled resource consumption (CVE-2026-126161). Brief link: https://feed.craftedsignal.io/briefs/2026-11-fortimail-dos-cve-2026-126161/
Triage facts
Revision 1- Applicability
- FortiMail (8.0.0 through 8.0.1), FortiMail (7.6.0 through 7.6.6) +1
- Evidence
- Unknown
- Severity
- Low
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 00:12 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Roughly even chance
Fortinet FortiMail is affected by an uncontrolled resource consumption vulnerability (CVE-2026-126161). The vulnerability allows a remote, unauthenticated attacker to cause a denial of service (DoS) condition on the affected device by sending repeated unauthenticated POST requests. The vulnerability is assigned a CVSS v3.1 base score of 7.5.
Impact
Successful exploitation results in a denial of service, rendering the affected FortiMail appliance unavailable to legitimate traffic and services.
Recommendation
Inventory all instances of Fortinet FortiMail running versions 8.0.0-8.0.1, 7.6.0-7.6.6, and 7.4.0-7.4.6. Monitor for vendor-provided security patches for these versions and apply them immediately upon release. Implement rate limiting on inbound POST requests to the FortiMail management and email gateway interfaces to mitigate the impact of this vulnerability until a patch is applied.
Immediate actions
Inventory Fortinet FortiMail instances on versions 8.0.0-8.0.1, 7.6.0-7.6.6, and 7.4.0-7.4.6.
Threat Hunt
Identify spikes in HTTP POST request volume originating from external IP addresses to FortiMail appliances.
Data: FortiMail system logs, Web server access logs, Firewall/WAF logs
Mitigations
Configure rate-limiting policies for inbound POST requests on public-facing FortiMail interfaces.
CVE-2026-126161