FortiMail SQL injection may allow unauthorised code execution (CVE-2026-126263)

What happened

The CVE record describes an SQL injection vulnerability (CWE-89) in Fortinet FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.4, and 7.4.0 through 7.4.6. An attacker can send specially crafted requests to execute unauthorised code or commands.

The CVSS v3.1 score is 9.4, rated critical. The vector indicates a network attack path, low complexity, high impact on confidentiality, integrity and availability, and no privileges required. The CVE description says an authenticated attacker; the vector sets privileges required to none, and the record does not explain the discrepancy. The CVE record does not report active exploitation or public disclosure.

Who is affected

Fortinet FortiMail email security gateways running the following releases are affected:

• 8.0.0 through 8.0.1
• 7.6.0 through 7.6.4
• 7.4.0 through 7.4.6

FortiMail is typically deployed as an email security gateway, filtering inbound and outbound mail. Organisations that expose the FortiMail management or web interface to the internet or to untrusted networks should treat this as a priority.

What to do now

1. Confirm whether you run an affected FortiMail release.
2. Treat this as unpatched: no fixed release is listed in the CVE record as of 12 November 2026, and no workaround has been published.
3. Restrict network access to the FortiMail management and web interfaces. Remove them from public reach or place them behind a VPN or administrative jump host if they do not need to be internet-facing.
4. Enforce multi-factor authentication and least-privilege access for all accounts able to reach FortiMail.
5. Monitor Fortinet's advisory for this CVE for a fix and further guidance.

How to detect it

No vendor indicators have been published for this issue. Start by confirming whether the FortiMail administrative or web interface is reachable from the internet or other untrusted networks; the CVSS vector describes a network-based attack path. Review access logs for unexpected connections to FortiMail from sources with no business need to reach it.

Beyond the patch

An email security gateway with a critical, unpatched SQL injection flaw is an exposure problem before it is a patching task. Virtual CISO Services (vCISO) can help map where FortiMail and similar appliances are reachable and prioritise what to restrict now, while Implementation & Assessment Services can run a penetration test and hardening review for injection and authentication flaws.