CVE-2006-1966: An unspecified Fortinet product, possibly Fortinet28, allows remote attackers to cause a denial of service...

Security readout for executives and security teams

This CVE describes a disputed 2006 report that an unspecified Fortinet product, possibly "Fortinet28", could be knocked offline by a small SYN flood against SMTP/TCP 25. The record lacks confirmed affected versions, severity, CVSS, or vendor fix. Follow-up posts disputed whether this was a vulnerability or expected protection behavior causing resets. Exposure can only be assessed for legacy Fortinet systems that expose SMTP/TCP 25 to untrusted networks and match the vague "Fortinet28" description. The source bundle provides no reliable product mapping, affected version list, or CPEs, so broad Fortinet exposure should not be assumed. Low urgency unless the organization still operates legacy Fortinet equipment with public SMTP exposure. The record is old, disputed, and lacks confirmed affected versions or remediation. Prioritize inventory confirmation and compensating controls over emergency action. Mitigation focus: Check Fortinet guidance for the specific legacy product and firmware in use.; Restrict SMTP/TCP 25 exposure to trusted mail peers where operationally possible.; Use upstream DDoS or firewall rate controls for public SMTP-facing services..

Prepared

Jun 29, 2026, 13:09 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.