{"id":"CVE-2026-126162","kind":"vulnerability","aliases":["CVE-2026-126162"],"related":[],"title":"FortiMail: unauthenticated XML injection in Exchange Integration allows code execution","description":"A xml injection (aka blind xpath injection) vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6 may allow a remote unauthenticated attacker to execute unauthorized code or commands via a specially crafted request.","summary":"FortiMail 8.0.0 through 8.0.1 and 7.6.0 through 7.6.6 contain an XML injection flaw (also described as blind XPath injection) in a request handler. A remote unauthenticated attacker can send a crafted request to execute unauthorized code or commands on the appliance.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiMail","fixed":["8.0.2","7.6.7"],"affected":">= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.6","ecosystem":"vendor"}],"ecosystems":[],"tags":["email-security","fortimail","fortinet","infrastructure","self-hosted"],"not_affected_if":["fortimail-7.4","fortimail-cloud","unaffected-version"],"how_to_check":"Check the FortiMail firmware version (admin GUI dashboard or CLI 'get system status'). Affected: 8.0.0-8.0.1 and 7.6.0-7.6.6. Safe: 8.0.2+, 7.6.7+, 7.4.x. The flaw is in the FortiMail Exchange Integration component; the advisory does not say whether it needs to be configured, so treat any affected version as exposed and restrict access to the appliance's API/web interface from untrusted networks until patched.","fix":"Upgrade FortiMail 8.0.0-8.0.1 to 8.0.2 or above; 7.6.0-7.6.6 to 7.6.7 or above. FortiMail 7.4 is not affected. FortiMail Cloud was already updated by Fortinet (Oct 5, 2026); no customer action.","status":"open","published_at":"2026-11-11T22:17:14+00:00","first_seen_at":"2026-11-11T22:29:28+00:00","triaged_at":"2026-11-11T22:31:27+00:00","updated_at":"2026-11-11T22:47:26+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-11-11T22:31:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Fortinet FortiMail: unauthenticated XML injection allows remote code execution","impact":"high","summary":"FortiMail 8.0.0 through 8.0.1 and 7.6.0 through 7.6.6 contain an XML injection flaw (also described as blind XPath injection) in a request handler. A remote unauthenticated attacker can send a crafted request to execute unauthorized code or commands on the appliance.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortimail","email-security","fortinet"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker runs unauthorized code or commands on the appliance","analyst_note":"Check the Fortinet PSIRT advisory for the fixed FortiMail versions and any workaround, and confirm which interfaces are exposed to the request path.","how_to_check":"- Check the installed FortiMail version in the admin web interface or with the vendor's version output, and compare it with the affected ranges.\n- Confirm whether the management or web interface is reachable from the internet.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Organizations running FortiMail email security appliances on the affected 8.0.x or 7.6.x versions. Exposure depends on whether the appliance's web or management interface is reachable by untrusted networks; the sources do not say which configurations are affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000736,"input_tokens":4577,"output_tokens":557,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Fortinet PSIRT advisory for the fixed FortiMail versions and any workaround, and confirm which interfaces are exposed to the request path.","search":"'-126162':13A,16A '-2026':12A,15A '7.6.0':32B,83C '7.6.6':34B,85C '8.0.0':28B,79C '8.0.1':30B,81C 'aka':71C 'allow':8A,87C 'also':40B 'applianc':67B 'attack':53B,91C 'blind':43B,72C 'code':9A,62B,95C 'command':64B,97C 'contain':35B 'craft':57B,101C 'cve':11A,14A 'describ':41B 'email':19B 'email-secur':18B 'exchang':6A 'execut':10A,60B,93C 'flaw':39B 'fortimail':1A,17A,21B,27B,78C,82C 'fortinet':22B,77C 'handler':49B 'host':26B 'infrastructur':23B 'inject':4A,38B,45B,70C,74C 'integr':7A 'may':86C 'remot':51B,89C 'request':48B,58B,102C 'secur':20B 'self':25B 'self-host':24B 'send':55B 'special':100C 'unauthent':2A,52B,90C 'unauthor':61B,94C 'via':98C 'vulner':75C 'xml':3A,37B,69C 'xpath':44B,73C","nicknames":[],"mitigations":[],"who_affected":"Organizations running self-managed FortiMail appliances (hardware or VM) on 8.0.0-8.0.1 or 7.6.0-7.6.6. The flaw is in the FortiMail Exchange Integration component and is reachable by an unauthenticated remote attacker. FortiMail 7.4 and FortiMail Cloud (already patched by Fortinet) can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:47:26Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-214","run_id":3662},"products":{"at":"2026-11-11T22:47:26Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-214","run_id":3662},"who_affected":{"at":"2026-11-11T22:47:26Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-214","run_id":3662}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["fortimail"],"ptokens":["fortimail"],"labels":["emailsecurity","fortimail","fortinet","high","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-126162':13A,16A '-2026':12A,15A 'allow':8A 'code':9A 'cve':11A,14A 'exchang':6A 'execut':10A 'fortimail':1A,17A 'inject':4A 'integr':7A 'unauthent':2A 'xml':3A","search_b":"'7.6.0':32B '7.6.6':34B '8.0.0':28B '8.0.1':30B 'also':40B 'applianc':67B 'attack':53B 'blind':43B 'code':62B 'command':64B 'contain':35B 'craft':57B 'describ':41B 'email':19B 'email-secur':18B 'execut':60B 'flaw':39B 'fortimail':21B,27B 'fortinet':22B 'handler':49B 'host':26B 'infrastructur':23B 'inject':38B,45B 'remot':51B 'request':48B,58B 'secur':20B 'self':25B 'self-host':24B 'send':55B 'unauthent':52B 'unauthor':61B 'xml':37B 'xpath':44B","search_c":"'7.6.0':83C '7.6.6':85C '8.0.0':79C '8.0.1':81C 'aka':71C 'allow':87C 'attack':91C 'blind':72C 'code':95C 'command':97C 'craft':101C 'execut':93C 'fortimail':78C,82C 'fortinet':77C 'inject':70C,74C 'may':86C 'remot':89C 'request':102C 'special':100C 'unauthent':90C 'unauthor':94C 'via':98C 'vulner':75C 'xml':69C 'xpath':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126162","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126162","severity":null,"published_at":"2026-11-11T22:17:14+00:00","modified_at":"2026-11-11T22:17:14+00:00","first_seen_at":"2026-11-11T22:29:28+00:00","fetched_at":"2026-11-11T22:29:28+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126162:3662","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-214","severity":null,"published_at":"2026-11-11T22:47:26+00:00","modified_at":"2026-11-11T22:47:26+00:00","first_seen_at":"2026-11-11T22:47:26+00:00","fetched_at":"2026-11-11T22:47:26+00:00","note":"Read Fortinet PSIRT FG-IR-26-214: fixed 8.0.2 / 7.6.7; 7.4 not affected; FortiMail Cloud already patched Oct 5 2026; no virtual patch, not known exploited.","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-214"]}],"documents":[{"id":129717,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-214","title":"Fortinet PSIRT FG-IR-26-214: XML injection in FortiMail","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}