CVE-2025-57739: SQL Injection
An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 through 7.4.5, FortiMail 7.2.0 through 7.2.8 allows an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP or HTTPS requests.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FortiMailto a version that resolves this vulnerability.Fixed in 7.2.9 - Upgrade
Upgrade
FortiMailto a version that resolves this vulnerability.Fixed in 7.4.6 - Upgrade
Upgrade
FortiMailto a version that resolves this vulnerability.Fixed in 7.6.4 - Upgrade
Upgrade
FortiMailto a version that resolves this vulnerability.Fixed in 8.0.0
Event History
Frequently Asked Questions
Which FortiMail versions are affected?
Affected releases are FortiMail 7.6.0 through 7.6.3, 7.4.0 through 7.4.5, and 7.2.0 through 7.2.8.
Does exploitation require authentication or user interaction?
An attacker must be authenticated with at least low privileges. No user interaction is required, and exploitation is performed through crafted HTTP or HTTPS requests.
What impact could successful exploitation have?
Successful exploitation can allow execution of unauthorized code or commands. The vulnerability is rated high severity with high impact to confidentiality, integrity, and availability.