Cve-2026-126162 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2026-126162/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 00:14:37 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgFortinet FortiMail: XML and Blind XPath Injection (CVE-2026-126162)https://feed.craftedsignal.io/briefs/2026-11-fortimail-xml-injection-cve-2026-126162/Thu, 12 Nov 2026 00:14:37 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-fortimail-xml-injection-cve-2026-126162/Fortinet FortiMail versions 8.0.0 through 8.0.1 and 7.6.0 through 7.6.6 are vulnerable to XML injection, which can lead to remote unauthenticated code execution via specially crafted requests.Fortinet FortiMail versions 8.0.0 through 8.0.1 and 7.6.0 through 7.6.6 contain an XML injection vulnerability, identified as blind XPath injection (CVE-2026-126162). This vulnerability allows a remote, unauthenticated attacker to manipulate XPath expressions through a specially crafted request, potentially leading to unauthorized command or code execution.

Impact

Successful exploitation allows an unauthenticated remote attacker to execute unauthorized code or commands on the affected FortiMail device. The CVSS 3.1 base score for this vulnerability is 8.7.

Recommendation

Monitor Fortinet security bulletins for firmware patches addressing CVE-2026-126162. Organizations currently running FortiMail versions 8.0.0-8.0.1 or 7.6.0-7.6.6 should inventory these assets and prepare for immediate patching upon release of the fix.

]]>highadvisorycve-2026-126162xml-injectionrce