---
id: "CVE-2026-126164"
page: "https://infrastack.ai/live/CVE-2026-126164"
kind: "vulnerability"
aliases: ["CVE-2026-126164"]
title: "Fortinet FortiMail: unauthenticated SQL injection lets attackers run commands"
severity: "critical"
cvss: 9.4
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["email-security", "fortimail", "fortinet", "self-hosted", "vendor"]
not_affected_if: ["other-fortinet-products", "versions-outside-listed-ranges"]
published_at: "2026-11-11T22:17:14+00:00"
first_seen_at: "2026-11-11T22:29:29+00:00"
updated_at: "2026-11-11T22:31:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126164", "first_seen_at": "2026-11-11T22:29:29+00:00"}]
exploit_sources: []
---

# Fortinet FortiMail: unauthenticated SQL injection lets attackers run commands

Link for people: https://infrastack.ai/live/CVE-2026-126164 (this .md is for agents)

Fortinet FortiMail email security appliances contain an SQL injection flaw in several 8.0, 7.6, 7.4 and 7.2 releases. An unauthenticated attacker can send crafted requests to execute unauthorized code or commands.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed FortiMail version in the admin interface or with the vendor's version command, and compare it against the affected ranges: 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all 7.2 versions.

## Fix

- Move FortiMail 8.0 to a fixed release above `8.0.1`, 7.6 above `7.6.6`, and 7.4 above `7.4.8`; the sources do not name the exact fixed build.
- FortiMail 7.2: unknown, as the sources give no fixed version for that branch.

## Timeline

- 2026-11-11T22:29:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126164

## From the sources

A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_