Is CVE-2026-127121 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-127121 being exploited in the wild.

How severe is CVE-2026-127121?

Medium severity, with a CVSS score of 6.5, published 12 November 2026.

Is there a fix for CVE-2026-127121?

Yes: fixed in SOGo 5.12.13. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-127121 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-127121?

Check whether you run Alinto Sogo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-127121: SOGo improper cryptographic signature verification in S/MIME

CVE-2026-127121 · Severity: medium · CVSS 6.5 · Published 2026-11-12

SOGo is a groupware suite that manages email, calendars, and contacts. An attacker can send a spoofed email that tricks SOGo into storing the attacker's certificate as a contact's trusted encryption key, allowing the attacker to decrypt future encrypted messages intended for that contact. This enables man-in-the-middle attacks on encrypted communications.

Technologies: Alinto Sogo. Vendors: Alinto.

Quick answers

Is CVE-2026-127121 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-127121 being exploited in the wild.
How severe is CVE-2026-127121?: Medium severity, with a CVSS score of 6.5, published 12 November 2026.
Which products and versions are affected?: Alinto Sogo before 5.12.13.
Is there a fix for CVE-2026-127121?: Yes: fixed in SOGo 5.12.13. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-127121 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-127121?: Check whether you run Alinto Sogo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: SOGo 5.12.13

Technical details

SOGo's UIxMailView component fails to validate S/MIME signature authenticity when processing multipart/signed messages, accepting a crafted CMS signedData object with a mismatched signature and storing the attacker's self-signed certificate on the contact card without identity verification. The vulnerability requires network access and user interaction (viewing a crafted email), and allows an attacker to intercept and decrypt subsequent encrypted communications between the victim and the impersonated contact.

Affected products

Alinto SOGo before 5.12.13

Timeline

2026-11-12: disclosed
2026-11-04: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.