FortiMail SQL injection may let unauthenticated attackers execute code (CVE-2026-126164)

What happened

Fortinet's advisory FG-IR-26-216 describes an SQL injection vulnerability in FortiMail. In an SQL injection flaw, a crafted request can cause the application to interpret parts of the input as SQL commands rather than data. The flaw is reachable over the network without authentication and requires no user interaction. An attacker who can reach a vulnerable FortiMail interface can send crafted requests that may allow execution of unauthorized code or commands.

The CVSS 3.1 vector scores this 9.4 critical, with high impact on confidentiality and integrity and limited impact on availability. Fortinet has not said the vulnerability is being exploited, and it is not listed in CISA KEV. The CVE record was published on 11 November 2026.

Who is affected

Fortinet lists the following FortiMail releases as affected:

• 8.0.0 through 8.0.1
• 7.6.0 through 7.6.6
• 7.4.0 through 7.4.8
• 7.2.0 through 7.2.9

FortiMail is an email security gateway, often placed where inbound and outbound mail is filtered. Organisations running one of these versions should treat reachability from untrusted networks as the immediate concern.

What to do now

1. Restrict exposure immediately. The flaw is reachable over the network without credentials or user interaction, so confirm FortiMail management and mail interfaces are not reachable from untrusted networks. Limit access to trusted hosts or a VPN.
2. Track Fortinet's advisory FG-IR-26-216. Fortinet has not published a fixed version or a workaround yet.
3. If FortiMail is internet-facing, apply compensating network controls such as source-address restrictions and access logging, and review whether the gateway needs to accept connections from the open internet.
4. Keep the affected version ranges above as the scope; Fortinet has not named other releases as vulnerable.

How to detect it

Fortinet has not published indicators of compromise for this vulnerability. Start with exposure: confirm whether any FortiMail administration or mail-processing interface is reachable from the internet. Because the vulnerability is reachable over the network without authentication, such exposure is the condition an attacker would need.

Beyond the patch

Because this flaw is reachable over the network without credentials, the first question is whether FortiMail is exposed at all. Virtual CISO Services (vCISO) can map that exposure and prioritise containment, while Implementation & Assessment Services can test for SQL injection and broader hardening gaps. Until Fortinet publishes fixed versions, the practical work is reducing reachability and verifying how the gateway is placed.