{"id":"CVE-2026-126263","kind":"vulnerability","aliases":["CVE-2026-126263"],"related":[],"title":"FortiMail: SQL injection lets an authenticated user run unauthorized commands","description":"A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.4, FortiMail 7.4.0 through 7.4.6 may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted requests.","summary":"Fortinet FortiMail versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.4 and 7.4.0 through 7.4.6 contain an SQL injection flaw triggered by crafted requests. An attacker with an account can execute unauthorized code or commands on the mail appliance.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiMail","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["email-security","fortimail","fortinet","vendor"],"not_affected_if":["unaffected-version"],"how_to_check":"- Check the installed FortiMail version in the admin interface against the affected ranges: `8.0.0` to `8.0.1`, `7.6.0` to `7.6.4`, `7.4.0` to `7.4.6`","fix":"- Move to a FortiMail release later than the affected ranges; the sources do not name the fixed version","status":"open","published_at":"2026-11-11T22:17:26+00:00","first_seen_at":"2026-11-11T22:29:33+00:00","triaged_at":"2026-11-11T22:30:57+00:00","updated_at":"2026-11-11T22:30:57+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-11-11T22:30:57Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a FortiMail release later than the affected ranges; the sources do not name the fixed version","reach":"network","title":"FortiMail: SQL injection lets an authenticated user run unauthorized commands","impact":"high","summary":"Fortinet FortiMail versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.4 and 7.4.0 through 7.4.6 contain an SQL injection flaw triggered by crafted requests. An attacker with an account can execute unauthorized code or commands on the mail appliance.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortimail","email-security","fortinet"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker runs unauthorized code or commands on the appliance","analyst_note":"Confirm the fixed FortiMail release for each affected branch and whether any non-default configuration is required, via the Fortinet PSIRT advisory.","how_to_check":"- Check the installed FortiMail version in the admin interface against the affected ranges: `8.0.0` to `8.0.1`, `7.6.0` to `7.6.4`, `7.4.0` to `7.4.6`\n- unknown for other checks; the sources do not say","plain_action":"","product_name":"FortiMail","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"FortiMail mail gateways in the affected version ranges are exposed, and an attacker needs a valid account on the appliance first. The sources do not say whether the flaw depends on non-default settings, so teams running these versions should treat them as affected.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000772,"input_tokens":4580,"output_tokens":628,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-126263':13A,16A '-2026':12A,15A '7.4.0':34B,86C '7.4.6':36B,88C '7.6.0':30B,82C '7.6.4':32B,84C '8.0.0':27B,78C '8.0.1':29B,80C 'account':50B 'allow':90C 'applianc':60B 'attack':47B,93C 'authent':6A,92C 'code':54B,97C 'command':10A,56B,71C,99C 'contain':37B 'craft':44B,102C 'cve':11A,14A 'element':66C 'email':19B 'email-secur':18B 'execut':52B,95C 'flaw':41B 'fortimail':1A,17A,21B,25B,77C,81C,85C 'fortinet':22B,24B,76C 'improp':62C 'inject':3A,40B,73C 'let':4A 'mail':59B 'may':89C 'neutral':63C 'request':45B,103C 'run':8A 'secur':20B 'special':65C 'specif':101C 'sql':2A,39B,70C,72C 'trigger':42B 'unauthor':9A,53B,96C 'use':67C 'user':7A 'vendor':23B 'version':26B 'via':100C 'vulner':74C","nicknames":[],"mitigations":[],"who_affected":"FortiMail mail gateways in the affected version ranges are exposed, and an attacker needs a valid account on the appliance first. The sources do not say whether the flaw depends on non-default settings, so teams running these versions should treat them as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["fortimail"],"ptokens":["fortimail"],"labels":["critical","emailsecurity","fortimail","fortinet","vendor"],"campaign_type":null,"search_a":"'-126263':13A,16A '-2026':12A,15A 'authent':6A 'command':10A 'cve':11A,14A 'fortimail':1A,17A 'inject':3A 'let':4A 'run':8A 'sql':2A 'unauthor':9A 'user':7A","search_b":"'7.4.0':34B '7.4.6':36B '7.6.0':30B '7.6.4':32B '8.0.0':27B '8.0.1':29B 'account':50B 'applianc':60B 'attack':47B 'code':54B 'command':56B 'contain':37B 'craft':44B 'email':19B 'email-secur':18B 'execut':52B 'flaw':41B 'fortimail':21B,25B 'fortinet':22B,24B 'inject':40B 'mail':59B 'request':45B 'secur':20B 'sql':39B 'trigger':42B 'unauthor':53B 'vendor':23B 'version':26B","search_c":"'7.4.0':86C '7.4.6':88C '7.6.0':82C '7.6.4':84C '8.0.0':78C '8.0.1':80C 'allow':90C 'attack':93C 'authent':92C 'code':97C 'command':71C,99C 'craft':102C 'element':66C 'execut':95C 'fortimail':77C,81C,85C 'fortinet':76C 'improp':62C 'inject':73C 'may':89C 'neutral':63C 'request':103C 'special':65C 'specif':101C 'sql':70C,72C 'unauthor':96C 'use':67C 'via':100C 'vulner':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126263","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126263","severity":null,"published_at":"2026-11-11T22:17:26+00:00","modified_at":"2026-11-11T22:17:26+00:00","first_seen_at":"2026-11-11T22:29:33+00:00","fetched_at":"2026-11-11T22:29:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}