Paper/Archive/CVE-2026-126164

CVE-2026-126164

Fortinet FortiMail — A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiMail 8.0.0 through…

CVSS 9.4

critical.is priorityof 100

CVSS 9.4 (CNA)9.4 / 10 × 3028.2 Not in CISA KEV+300.0 No EPSS score.000 × 200.0 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.

Affected

ProductAffectedFixed inSource

FortiMail8.0.0 – 8.0.1–CNA

FortiMail7.6.0 – 7.6.6–CNA

FortiMail7.4.0 – 7.4.8–CNA

FortiMail7.2.0 – 7.2.9–CNA

Scores by source

fortinet (CNA)9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C

References

reffortiguard.fortinet.com/psirt/FG-IR-26-216