Fortinet FortiMail SQL Injection Vulnerability (CVE-2026-126164)
An SQL injection vulnerability in Fortinet FortiMail allows an unauthenticated attacker to execute unauthorized code or commands via crafted requests.
CVE search metadata
CVE search record: CVE-2026-126164. Severity: critical. CVSS: 9.4. KEV: no. Product: FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions. Brief: Fortinet FortiMail SQL Injection Vulnerability (CVE-2026-126164). Brief link: https://feed.craftedsignal.io/briefs/2026-11-fortinet-fortimail-sql-injection-cve-2026-126164/
Triage facts
Revision 1- Applicability
- FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6 +2
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 04:03 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Fortinet FortiMail versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all 7.2 versions contain an improper neutralization of special elements used in an SQL command (SQL injection). This vulnerability allows an unauthenticated attacker to execute unauthorized code or commands via crafted requests.
Impact
The vulnerability is classified with a CVSS v3.1 base score of 9.4, indicating critical impact.
Recommendation
Review the vendor's security advisory to identify necessary remediation steps.