Quick answers
- Is CVE-2026-126162 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-126162 being exploited in the wild.
- How severe is CVE-2026-126162?
- High severity, with a CVSS score of 8.7, published 11 November 2026.
- Which products and versions are affected?
- Fortinet FortiMail 7.6.0 through 7.6.6, 8.0.0 through 8.0.1.
- Is there a fix for CVE-2026-126162?
- Yes: fixed in FortiMail 7.6.7 or above, 8.0.2 or above. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-126162 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-126162?
- Check whether you run Fortinet FortiMail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: FortiMail 7.6.7 or above, 8.0.2 or above
Technical details
An XML Injection/Blind XPath Injection vulnerability (CWE-91) exists in the FortiMail Exchange Integration API component. A remote unauthenticated attacker can send a specially crafted request to exploit this flaw and execute unauthorized code or commands. The vulnerability affects FortiMail versions 7.6.0–7.6.6 and 8.0.0–8.0.1.
Affected products
- Fortinet FortiMail 7.6.0 through 7.6.6, 8.0.0 through 8.0.1
Timeline
- 2026-11-10: disclosed: Initial publication by Fortinet PSIRT
- 2026-10-05: patched: FortiMail Cloud remediated
- 2026-11-11: advisory: NVD publication