---
id: "CVE-2026-126263"
page: "https://infrastack.ai/live/CVE-2026-126263"
kind: "vulnerability"
aliases: ["CVE-2026-126263"]
title: "FortiMail: SQL injection lets an authenticated user run unauthorized commands"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "FortiMail", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["email-security", "fortimail", "fortinet", "vendor"]
not_affected_if: ["unaffected-version"]
published_at: "2026-11-11T22:17:26+00:00"
first_seen_at: "2026-11-11T22:29:33+00:00"
updated_at: "2026-11-11T22:30:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126263", "first_seen_at": "2026-11-11T22:29:33+00:00"}]
exploit_sources: []
---

# FortiMail: SQL injection lets an authenticated user run unauthorized commands

Link for people: https://infrastack.ai/live/CVE-2026-126263 (this .md is for agents)

Fortinet FortiMail versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.4 and 7.4.0 through 7.4.6 contain an SQL injection flaw triggered by crafted requests. An attacker with an account can execute unauthorized code or commands on the mail appliance.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiMail affected range not listed fixed no fixed version listed

## How to check

- Check the installed FortiMail version in the admin interface against the affected ranges: `8.0.0` to `8.0.1`, `7.6.0` to `7.6.4`, `7.4.0` to `7.4.6`

## Fix

- Move to a FortiMail release later than the affected ranges; the sources do not name the fixed version

## Timeline

- 2026-11-11T22:29:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126263

## From the sources

A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.4, FortiMail 7.4.0 through 7.4.6 may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted requests.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_