FortiMail
CVE-2025-57739: SQL injection in FortiMail
An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 through 7.4.5, FortiMail 7.2.0 through 7.2.8 allows an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP or HTTPS requests.
Published Fortinet advisory FG-IR-26-184
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| FortiMail 7.6.0 to 7.6.3 | 7.6.4 or later |
| FortiMail 7.4.0 to 7.4.5 | 7.4.6 or later |
| FortiMail 7.2.0 to 7.2.8 | 7.2.9 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
In short
A SQL injection flaw in FortiMail allows an authenticated attacker with a low-privileged account to execute unauthorized code or commands. By sending specifically crafted HTTP or HTTPS requests over the network, the attacker can exploit this improper neutralization of special elements to escalate their privileges. No user interaction is required for this attack to succeed.
Written by a language model from the vendor's description. Versions, fixes and exploitation status on this page come straight from the vendor and CISA.
The vendor's description
An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 through 7.4.5, FortiMail 7.2.0 through 7.2.8 allows an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP or HTTPS requests.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 20 Oct 2026.