Skip to content
Threat Feed
Subscribe
high advisory

Fortinet FortiMail: XML and Blind XPath Injection (CVE-2026-126162)

Fortinet FortiMail versions 8.0.0 through 8.0.1 and 7.6.0 through 7.6.6 are vulnerable to XML injection, which can lead to remote unauthenticated code execution via specially crafted requests.

CVE search metadata

CVE search record: CVE-2026-126162. Severity: high. CVSS: 8.7. KEV: no. Product: FortiMail (8.0.0 through 8.0.1), FortiMail (7.6.0 through 7.6.6). Brief: Fortinet FortiMail: XML and Blind XPath Injection (CVE-2026-126162). Brief link: https://feed.craftedsignal.io/briefs/2026-11-fortimail-xml-injection-cve-2026-126162/

Triage facts

Revision 1
Applicability
FortiMail (8.0.0 through 8.0.1), FortiMail (7.6.0 through 7.6.6)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
1 public source
Freshness
Revision 1Nov 12, 00:14 UTC
Vulnerabilities
1 CVE
Source quality
A1Roughly even chance

Fortinet FortiMail versions 8.0.0 through 8.0.1 and 7.6.0 through 7.6.6 contain an XML injection vulnerability, identified as blind XPath injection (CVE-2026-126162). This vulnerability allows a remote, unauthenticated attacker to manipulate XPath expressions through a specially crafted request, potentially leading to unauthorized command or code execution.

Impact

Successful exploitation allows an unauthenticated remote attacker to execute unauthorized code or commands on the affected FortiMail device. The CVSS 3.1 base score for this vulnerability is 8.7.

Recommendation

Monitor Fortinet security bulletins for firmware patches addressing CVE-2026-126162. Organizations currently running FortiMail versions 8.0.0-8.0.1 or 7.6.0-7.6.6 should inventory these assets and prepare for immediate patching upon release of the fix.

Immediate actions

Inventory all internet-facing FortiMail appliances to identify versions 8.0.0-8.0.1 and 7.6.0-7.6.6

IT Operations 48h

Threat Hunt

Investigate web server access logs for anomalous requests containing XML or XPath syntax characters (e.g., <, >, /, [, ], @) targeting FortiMail administrative or input fields.

T1190 medium medium confidence hunt now

Data: Web server access logs