Fortinet FortiMail: SQL injection in webmail allows code execution
Summary
Fortinet FortiMail 7.2.0 to 7.2.8, 7.4.0 to 7.4.5 and 7.6.0 to 7.6.3 contain an SQL injection flaw in the webmail interface. An authenticated attacker with a valid user account can send crafted HTTP or HTTPS requests to execute unauthorized code or commands. Fortinet classifies the impact as escalation of privilege. NVD and the CNA score the issue 8.8, while Fortinet's PSIRT lists 7.7.
Affected
- FortiMail 7.6.0 to 7.6.3
- FortiMail 7.4.0 to 7.4.5
- FortiMail 7.2.0 to 7.2.8
- FortiMail 8.0: not affected
- FortiMail Cloud: remediated by Fortinet, no customer action needed
Fixed in
- FortiMail 7.6: upgrade to 7.6.4 or above
- FortiMail 7.4: upgrade to 7.4.6 or above
- FortiMail 7.2: upgrade to 7.2.9 or above
Workaround
Unknown. No workaround is listed in FG-IR-26-184.
Exploitation
- Fortinet lists the vulnerability as not known to be exploited.
- No public proof of concept has been confirmed. One secondary news source reports none.
- CISA KEV status not verified on cisa.gov.
- CISA SSVC assessment: exploitation none, automatable no, technical impact total.
Our recommendation
- Upgrade FortiMail to the fixed build for your branch as soon as possible.
- Consider the newest build of your branch, as Fortinet also publishes fixes for other FortiMail issues.
- Plan an upgrade path for devices on 7.2.
- Restrict webmail and administration interfaces to trusted networks or VPN.
- Enforce multi-factor authentication for webmail accounts and review webmail login logs.
- Check the CISA KEV catalog for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fortinet PSIRT FG-IR-26-184 fortiguard.fortinet.com
- FortiMail 7.6.4 release notes fortinetweb.s3.amazonaws.com
- FortiMail 7.4.6 release notes fortinetweb.s3.amazonaws.com
- FortiMail 7.2.9 release notes fortinetweb.s3.amazonaws.com
- CVE Monitor entry CVE-2025-57739 cvemon.intruder.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 19:47.
Original description (NVD)
An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 through 7.4.5, FortiMail 7.2.0 through 7.2.8 allows an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP or HTTPS requests.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.