CVE-2025-57739

HighCVSS 8.8

Published: 13/10/2026(UTC)Updated: 15/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

22th percentile - higher than 22% of all known CVEs

Summary

An SQL Injection vulnerability (CWE-89) in Fortinet FortiMail 7.6.0 through 7.6.3, 7.4.0 through 7.4.5, and 7.2.0 through 7.2.8 allows an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP or HTTPS requests.

Risk Assessment

An authenticated attacker can execute unauthorized commands on the FortiMail system, potentially compromising data confidentiality and integrity.

Recommendation

Upgrade FortiMail to the latest version containing the fix provided by Fortinet.

Other vulnerabilities in FortiMail

CVE-2026-104286CriticalActively exploited
A path traversal vulnerability in Fortinet FortiMail (versions 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, 7.2.0-7.2.9) stems from improper limitation of a pathname to a restricted directory. An unauthenticated attacker can write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.

Original NVD description (English source)

An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 through 7.4.5, FortiMail 7.2.0 through 7.2.8 allows an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP or HTTPS requests.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS