High severity8.7NVD Advisory· Published Nov 11, 2026

CVE-2026-126162

Description

A xml injection (aka blind xpath injection) vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6 may allow a remote unauthenticated attacker to execute unauthorized code or commands via a specially crafted request.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Fortinetweb/Fortimailinferred
Range: >=7.6.0,<7.6.7
Fortinet/Fortimailllm-fuzzy
Range: 8.0.0 through 8.0.1, 7.6.0 through 7.6.6

Patches

Vulnerability mechanics

References

fortiguard.fortinet.com/psirt/FG-IR-26-214nvd

News mentions

No linked articles in our index yet.

cvss	0.565
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000