Fortinet FortiMail: Denial of Service via malicious attachment (CVE-2026-126165)

Fortinet FortiMail is vulnerable to a memory allocation issue involving excessive size values, identified as CVE-2026-126165. A remote, unauthenticated attacker can exploit this flaw by sending a specially crafted attachment via SMTP, which causes the appliance to crash or become unresponsive, resulting in a denial of service. The vulnerability impacts FortiMail versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all versions of 7.2.

Impact

The vulnerability allows for a denial of service (DoS) on affected FortiMail appliances. Successful exploitation leads to service disruption, preventing the appliance from processing mail traffic. The issue is rated with a CVSS v3.1 base score of 7.5.

Recommendation

• Identify all internet-facing FortiMail appliances within the environment.
• Monitor vendor security bulletins for the release of patched versions addressing CVE-2026-126165.
• In the absence of a patch, ensure that email gateways are configured with appropriate attachment size limits and content filtering policies to potentially reduce the exposure to malformed payloads.