Is CVE-2026-126149 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126149 being exploited in the wild.

How severe is CVE-2026-126149?

High severity, with a CVSS score of 7.5, published 11 November 2026.

Which products and versions are affected?

Fortinet FortiMail 7.2 all versions; 7.4.0-7.4.8; 7.6.0-7.6.6; 8.0.0-8.0.1.

Is there a fix for CVE-2026-126149?

Yes: fixed in FortiMail 7.4.9 and above; 7.6.7 and above; 8.0.2 and above. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-126149 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-126149?

Check whether you run Fortinet FortiMail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126149: Fortinet FortiMail integer overflow in smtpd

CVE-2026-126149 · Severity: high · CVSS 7.5 · Published 2026-11-11

FortiMail is an email security appliance that filters malicious emails and threats for organizations. An integer overflow vulnerability in the SMTP daemon allows remote attackers without authentication to crash the email service, causing a denial of service and disrupting email delivery.

Technologies: Fortinet FortiMail. Vendors: Fortinet.

Quick answers

Is CVE-2026-126149 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126149 being exploited in the wild.
How severe is CVE-2026-126149?: High severity, with a CVSS score of 7.5, published 11 November 2026.
Which products and versions are affected?: Fortinet FortiMail 7.2 all versions; 7.4.0-7.4.8; 7.6.0-7.6.6; 8.0.0-8.0.1.
Is there a fix for CVE-2026-126149?: Yes: fixed in FortiMail 7.4.9 and above; 7.6.7 and above; 8.0.2 and above. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126149 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-126149?: Check whether you run Fortinet FortiMail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: FortiMail 7.4.9 and above; 7.6.7 and above; 8.0.2 and above

Technical details

An integer overflow or wraparound vulnerability (CWE-190) exists in the FortiMail smtpd component. The vulnerability can be triggered by a remote unauthenticated attacker over the network, requiring no user interaction or prior authentication. Exploitation crashes the SMTP daemon, resulting in denial of service.

Affected products

Fortinet FortiMail 7.2 all versions; 7.4.0-7.4.8; 7.6.0-7.6.6; 8.0.0-8.0.1

Timeline

2026-11-10: disclosed: PSIRT advisory FG-IR-26-201 published

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-201

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.