CVE-2026-126263: SQL Injection

Published Nov 11, 2026

Updated

A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.4, FortiMail 7.4.0 through 7.4.6 may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted requests.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Fortinet FortiMail to a version that resolves this vulnerability.
Fixed in 7.4.7
Upgrade
Upgrade Fortinet FortiMail to a version that resolves this vulnerability.
Fixed in 7.6.7
Upgrade
Upgrade Fortinet FortiMail to a version that resolves this vulnerability.
Fixed in 8.0.2

Event History

Nov 11, 2026

CVE Published

via MITRE·09:31 PM

Data Sourced

via MITRE·09:31 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which FortiMail releases are affected?

Affected releases are FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.4, and 7.4.0 through 7.4.6.

Does exploitation require authentication or user interaction?

Exploitation requires an authenticated attacker. No user interaction is required.

What can an attacker achieve?

A successful attacker may execute unauthorized code or commands by sending specifically crafted requests.