{"id":"CVE-2026-126164","kind":"vulnerability","aliases":["CVE-2026-126164"],"related":[],"title":"Fortinet FortiMail: unauthenticated SQL injection lets attackers run commands","description":"A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.","summary":"Fortinet FortiMail email security appliances contain an SQL injection flaw in several 8.0, 7.6, 7.4 and 7.2 releases. An unauthenticated attacker can send crafted requests to execute unauthorized code or commands.","severity":"critical","cvss":9.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["email-security","fortimail","fortinet","self-hosted","vendor"],"not_affected_if":["other-fortinet-products","versions-outside-listed-ranges"],"how_to_check":"- Check the installed FortiMail version in the admin interface or with the vendor's version command, and compare it against the affected ranges: 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all 7.2 versions.","fix":"- Move FortiMail 8.0 to a fixed release above `8.0.1`, 7.6 above `7.6.6`, and 7.4 above `7.4.8`; the sources do not name the exact fixed build.\n- FortiMail 7.2: unknown, as the sources give no fixed version for that branch.","status":"open","published_at":"2026-11-11T22:17:14+00:00","first_seen_at":"2026-11-11T22:29:29+00:00","triaged_at":"2026-11-11T22:31:05+00:00","updated_at":"2026-11-11T22:31:05+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-11T22:31:05Z","model":"claude-haiku-5-5","output":{"fix":"- Move FortiMail 8.0 to a fixed release above `8.0.1`, 7.6 above `7.6.6`, and 7.4 above `7.4.8`; the sources do not name the exact fixed build.\n- FortiMail 7.2: unknown, as the sources give no fixed version for that branch.","reach":"internet","title":"Fortinet FortiMail: unauthenticated SQL injection lets attackers run commands","impact":"high","summary":"Fortinet FortiMail email security appliances contain an SQL injection flaw in several 8.0, 7.6, 7.4 and 7.2 releases. An unauthenticated attacker can send crafted requests to execute unauthorized code or commands.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortimail","fortinet","email-security","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Unauthenticated attacker runs unauthorized code or commands on the appliance","analyst_note":"Check Fortinet's PSIRT advisory for the fixed FortiMail 7.2 build and any workaround; the sources only give NVD's description.","how_to_check":"- Check the installed FortiMail version in the admin interface or with the vendor's version command, and compare it against the affected ranges: 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all 7.2 versions.\n- unknown for any other check, as the sources do not say.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-fortinet-products","versions-outside-listed-ranges"],"who_is_affected":"FortiMail email security appliances in the listed versions are exposed, and the flaw needs no login. Teams running other Fortinet products or FortiMail releases outside these ranges can skip it. The sources do not say whether a non-default setting is required.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000813,"input_tokens":4592,"output_tokens":708,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-126164':12A,15A '-2026':11A,14A '7.2':41B,85C '7.4':39B '7.4.0':81C '7.4.8':83C '7.6':38B '7.6.0':77C '7.6.6':79C '8.0':37B '8.0.0':73C '8.0.1':75C 'allow':89C 'applianc':29B 'attack':7A,45B,92C 'code':53B,96C 'command':9A,55B,66C,98C 'contain':30B 'craft':48B,100C 'cve':10A,13A 'element':61C 'email':17B,27B 'email-secur':16B 'execut':51B,94C 'flaw':34B 'fortimail':2A,19B,26B,72C,76C,80C,84C 'fortinet':1A,20B,25B,71C 'host':23B 'improp':57C 'inject':5A,33B,68C 'let':6A 'may':88C 'neutral':58C 'releas':42B 'request':49B,101C 'run':8A 'secur':18B,28B 'self':22B 'self-host':21B 'send':47B 'sever':36B 'special':60C 'sql':4A,32B,65C,67C 'unauthent':3A,44B,91C 'unauthor':52B,95C 'use':62C 'vendor':24B 'version':87C 'via':99C 'vulner':69C","nicknames":[],"mitigations":[],"who_affected":"FortiMail email security appliances in the listed versions are exposed, and the flaw needs no login. Teams running other Fortinet products or FortiMail releases outside these ranges can skip it. The sources do not say whether a non-default setting is required.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","emailsecurity","fortimail","fortinet","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126164':12A,15A '-2026':11A,14A 'attack':7A 'command':9A 'cve':10A,13A 'fortimail':2A 'fortinet':1A 'inject':5A 'let':6A 'run':8A 'sql':4A 'unauthent':3A","search_b":"'7.2':41B '7.4':39B '7.6':38B '8.0':37B 'applianc':29B 'attack':45B 'code':53B 'command':55B 'contain':30B 'craft':48B 'email':17B,27B 'email-secur':16B 'execut':51B 'flaw':34B 'fortimail':19B,26B 'fortinet':20B,25B 'host':23B 'inject':33B 'releas':42B 'request':49B 'secur':18B,28B 'self':22B 'self-host':21B 'send':47B 'sever':36B 'sql':32B 'unauthent':44B 'unauthor':52B 'vendor':24B","search_c":"'7.2':85C '7.4.0':81C '7.4.8':83C '7.6.0':77C '7.6.6':79C '8.0.0':73C '8.0.1':75C 'allow':89C 'attack':92C 'code':96C 'command':66C,98C 'craft':100C 'element':61C 'execut':94C 'fortimail':72C,76C,80C,84C 'fortinet':71C 'improp':57C 'inject':68C 'may':88C 'neutral':58C 'request':101C 'special':60C 'sql':65C,67C 'unauthent':91C 'unauthor':95C 'use':62C 'version':87C 'via':99C 'vulner':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126164","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126164","severity":null,"published_at":"2026-11-11T22:17:14+00:00","modified_at":"2026-11-11T22:17:14+00:00","first_seen_at":"2026-11-11T22:29:29+00:00","fetched_at":"2026-11-11T22:29:29+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}