FortiMail: a pre-auth RCE in the POP3 service (CVE-2026-44812) joins the CISA KEV
> TL;DR: A heap buffer overflow in the FortiMail POP3 service allows unauthenticated remote code execution (CVE-2026-44812, CVSS 8.8). CISA added it to the Known Exploited Vulnerabilities on October 2, 2026, deadline October 30. Fixed in FortiMail 7.6.6 and 8.0.4. A FortiMail instance is a mail gateway: the entry point that handles the mail of the whole organization.
Why a POP3 service matters
FortiMail is a mail gateway: inbound/outbound SMTP, and mailbox access via IMAP, POP3, and webmail. Most organizations close SMTP submission but leave the mailbox protocols open — POP3 on port 110, often without TLS.
That is exactly the protocol that is affected: the POP3 service handles the \USER\\/\\AUTH\\ exchange before authentication. The overflow happens in the parsing of the \AUTH\\ response — a crafted sequence (STLS, USER, then an abnormally long \AUTH\\ token) overflows a heap buffer and redirects execution.
The PoC (Fortinet PSIRT, vendor-confirmed): RCE as root, no credentials needed.
What root on the gateway gives the attacker
A mail gateway is one of the richest entry points in an organization — and historically one of the least tested.
Who is affected
What to check now
AUTH\\ exchanges from new source IPs in the last 7 days, unexpected files in \/var/tmp\\, new local accounts, processes not spawned by the mail service.The lesson
Mail is the only data flow where an external party can inject content (body, attachments) over protocol paths that have survived every migration. POP3, IMAP, EAS: the older the protocol, the more likely the parsing is a weak point. When a vendor says "affected service = POP3", the question to ask is: "is POP3 still listening, and for whom?"
Building software? CleanIssue performs security audits for your product in real-world conditions, no source code access needed. For a first read of your exposure, start with an external review of your application.
Related articles
Three adjacent analyses to keep exploring the same attack surface.
Citrix NetScaler: CVE-2026-88779, a third pre-auth RCE that also hits the 88771/88772-patched builds — CISA KEV
CISA lists CVE-2026-88779 in the Known Exploited Vulnerabilities: pre-authentication RCE via a race condition in the Web Interface session manager, CVSS 9.1, also affecting the versions fixed for 88771/88772. watchTowr has a PoC, 43,812 instances remain exposed, CISA deadline October 30.
Citrix NetScaler: two pre-auth RCEs, 50,277 exposed instances, CISA deadline Sept 30
CISA lists CVE-2026-88771 and CVE-2026-88772 in the Known Exploited Vulnerabilities: pre-authentication code execution on NetScaler ADC and Gateway, CVSS 9.5. watchTowr has a PoC, GreyNoise observed the first exploitations on September 24, and over 50,000 instances remain exposed.
Palo Alto PAN-OS: CVE-2026-0322 exploited, no workaround, and three days for federal agencies
CISA adds CVE-2026-0322 to the KEV on October 14: code execution on the PAN-OS management interface, exploited in limited attacks. No known workaround, fixes per branch, federal deadline October 17.
Sources
Related services
If this topic maps to a real risk in your stack, these are the most relevant CleanIssue audits.