Is CVE-2026-127135 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-127135 being exploited in the wild.

How severe is CVE-2026-127135?

Medium severity, with a CVSS score of 4.3, published 12 November 2026.

Is there a fix for CVE-2026-127135?

Yes: fixed in SOGo 5.12.13. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-127135 attacked?

It is attacked over the network.

Am I affected by CVE-2026-127135?

Check whether you run Alinto Sogo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-127135: SOGo Sieve script injection in notification address

CVE-2026-127135 · Severity: medium · CVSS 4.3 · Published 2026-11-12

SOGo is a messaging and collaboration server that handles email, calendar, and contacts. A vulnerability in versions before 5.12.13 allows authenticated users to inject malicious Sieve mail filtering directives by manipulating notification settings, enabling attackers to redirect or discard incoming emails and bypass administrator-configured forwarding restrictions.

Technologies: Alinto Sogo. Vendors: Alinto.

Quick answers

Is CVE-2026-127135 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-127135 being exploited in the wild.
How severe is CVE-2026-127135?: Medium severity, with a CVSS score of 4.3, published 12 November 2026.
Which products and versions are affected?: Alinto Sogo before 5.12.13.
Is there a fix for CVE-2026-127135?: Yes: fixed in SOGo 5.12.13. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-127135 attacked?: It is attacked over the network.
Am I affected by CVE-2026-127135?: Check whether you run Alinto Sogo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: SOGo 5.12.13

Technical details

The vulnerability is a static code injection (CWE-96) in Sieve script generation, where notificationAddress preference values are not properly escaped before being embedded into Sieve scripts. An authenticated attacker can insert Sieve redirect or discard statements to bypass forwarding-domain constraints and manipulate mail delivery. The attack requires prior authentication but no additional user interaction.

Affected products

Alinto SOGo before 5.12.13

Timeline

2026-11-12: disclosed
2026-11-04: patched: Release SOGo 5.12.13

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.