CVE-2026-126162

Name of the Vulnerable Software and Affected Versions FortiMail versions 8.0.0 through 8.0.1 FortiMail versions 7.6.0 through 7.6.6

Description An XML injection issue, also known as blind XPath injection, allows a remote unauthenticated attacker to execute unauthorized code or commands by sending a specially crafted request. Blind XPath injection is a technique where an attacker uses XPath queries to extract data from an XML document by observing the application's response to true or false conditions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.