Fortinet FortiMail: Integer overflow denial of service (CVE-2026-126149)
An integer overflow vulnerability in Fortinet FortiMail allows remote, unauthenticated attackers to cause a denial-of-service condition by crashing the mail daemon.
CVE search metadata
CVE search record: CVE-2026-126149. Severity: high. CVSS: 7.5. KEV: no. Product: FortiMail (8.0.0 through 8.0.1), FortiMail (7.6.0 through 7.6.6), FortiMail (7.4.0 through 7.4.8), FortiMail (7.2 all versions). Brief: Fortinet FortiMail: Integer overflow denial of service (CVE-2026-126149). Brief link: https://feed.craftedsignal.io/briefs/2026-11-fortinet-fortimail-dos-cve-2026-126149/
Triage facts
Revision 1- Applicability
- FortiMail (8.0.0 through 8.0.1), FortiMail (7.6.0 through 7.6.6) +2
- Evidence
- Unknown
- Severity
- Low
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 00:10 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Roughly even chance
An integer overflow or wraparound vulnerability (CVE-2026-126149) has been identified in multiple versions of Fortinet FortiMail. This vulnerability permits a remote, unauthenticated attacker to crash the affected mail daemon, resulting in a denial-of-service condition. The vulnerability has been assigned a CVSS v3.1 base score of 7.5.
Impact
Successful exploitation results in the crash of the FortiMail mail daemon, causing a denial of service for affected email processing infrastructure.
Recommendation
Review the affected product list and apply vendor-provided patches as soon as they become available. Until patches are applied, monitor for anomalous crash activity in mail daemon logs to identify potential exploitation attempts.
Immediate actions
Inventory all internet-facing FortiMail instances and verify running versions against the affected list.
Threat Hunt
Hunt for recurrent crashes of the FortiMail mail daemon or abnormal service restarts in system logs.
Data: FortiMail system logs, Daemon crash reports
Mitigations
Monitor vendor advisories for specific patch version releases for CVE-2026-126149 and prepare for deployment.
CVE-2026-126149