---
id: "CVE-2026-126162"
page: "https://infrastack.ai/live/CVE-2026-126162"
kind: "vulnerability"
aliases: ["CVE-2026-126162"]
title: "FortiMail: unauthenticated XML injection in Exchange Integration allows code execution"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "FortiMail", "fixed": ["8.0.2", "7.6.7"], "affected": ">= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.6", "ecosystem": "vendor"}]
ecosystems: []
tags: ["email-security", "fortimail", "fortinet", "infrastructure", "self-hosted"]
not_affected_if: ["fortimail-7.4", "fortimail-cloud", "unaffected-version"]
published_at: "2026-11-11T22:17:14+00:00"
first_seen_at: "2026-11-11T22:29:28+00:00"
updated_at: "2026-11-11T22:47:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126162", "first_seen_at": "2026-11-11T22:29:28+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-214", "first_seen_at": "2026-11-11T22:47:26+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-214"]}]
exploit_sources: []
---

# FortiMail: unauthenticated XML injection in Exchange Integration allows code execution

Link for people: https://infrastack.ai/live/CVE-2026-126162 (this .md is for agents)

FortiMail 8.0.0 through 8.0.1 and 7.6.0 through 7.6.6 contain an XML injection flaw (also described as blind XPath injection) in a request handler. A remote unauthenticated attacker can send a crafted request to execute unauthorized code or commands on the appliance.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiMail affected >= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.6 fixed 8.0.2, 7.6.7

## How to check

Check the FortiMail firmware version (admin GUI dashboard or CLI 'get system status'). Affected: 8.0.0-8.0.1 and 7.6.0-7.6.6. Safe: 8.0.2+, 7.6.7+, 7.4.x. The flaw is in the FortiMail Exchange Integration component; the advisory does not say whether it needs to be configured, so treat any affected version as exposed and restrict access to the appliance's API/web interface from untrusted networks until patched.

## Fix

Upgrade FortiMail 8.0.0-8.0.1 to 8.0.2 or above; 7.6.0-7.6.6 to 7.6.7 or above. FortiMail 7.4 is not affected. FortiMail Cloud was already updated by Fortinet (Oct 5, 2026); no customer action.

## Timeline

- 2026-11-11T22:29:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126162
- 2026-11-11T22:47:26+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-214 — Read Fortinet PSIRT FG-IR-26-214: fixed 8.0.2 / 7.6.7; 7.4 not affected; FortiMail Cloud already patched Oct 5 2026; no virtual patch, not known exploited.

## Documents

- [advisory] Fortinet PSIRT FG-IR-26-214: XML injection in FortiMail https://fortiguard.fortinet.com/psirt/FG-IR-26-214

## From the sources

A xml injection (aka blind xpath injection) vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6 may allow a remote unauthenticated attacker to execute unauthorized code or commands via a specially crafted request.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_