Paper/Archive/CVE-2026-126263

CVE-2026-126263

Fortinet FortiMail — A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiMail 8.0.0 through…

CVSS 9.4

critical.is priorityof 100

CVSS 9.4 (CNA)9.4 / 10 × 3028.2 Not in CISA KEV+300.0 No EPSS score.000 × 200.0 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.4, FortiMail 7.4.0 through 7.4.6 may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted requests.

Affected

ProductAffectedFixed inSource

FortiMail8.0.0 – 8.0.1–CNA

FortiMail7.6.0 – 7.6.4–CNA

FortiMail7.4.0 – 7.4.6–CNA

Scores by source

fortinet (CNA)9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C

References

reffortiguard.fortinet.com/psirt/FG-IR-26-277