CVE-2026-126162: High severity vulnerability

Published Nov 11, 2026

Updated

A xml injection (aka blind xpath injection) vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6 may allow a remote unauthenticated attacker to execute unauthorized code or commands via a specially crafted request.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Fortinet FortiMail to a version that resolves this vulnerability.
Fixed in 7.6.7
Upgrade
Upgrade Fortinet FortiMail to a version that resolves this vulnerability.
Fixed in 8.0.2

Event History

Nov 11, 2026

CVE Published

via MITRE·09:29 PM

Data Sourced

via MITRE·09:29 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which FortiMail versions are affected?

Affected versions are FortiMail 8.0.0 through 8.0.1 and FortiMail 7.6.0 through 7.6.6.

Does exploitation require authentication or user interaction?

No. The vulnerability may be exploited remotely by an unauthenticated attacker, and no user interaction is required.

What can an attacker potentially do?

A specially crafted request may allow unauthorized code or command execution. The reported impact includes high confidentiality and integrity impact, with no availability impact indicated.

CVE-2026-126162: High severity vulnerability

Remediation

Event History

Frequently Asked Questions

Which FortiMail versions are affected?

Does exploitation require authentication or user interaction?

What can an attacker potentially do?

Company

Resources

Contact

Frequently Asked Questions

Which FortiMail versions are affected?

Does exploitation require authentication or user interaction?

What can an attacker potentially do?