SQL command injection in webmail
Authenticated FortiMail webmail SQL injection can let attackers run commands, rated CVSS 7.7.
Fortinet PSIRT advisory FG-IR-26-184 discloses an SQL command injection (CWE-89) in FortiMail webmail. An authenticated attacker may execute unauthorized code or commands through specifically crafted HTTP requests. The flaw is scored CVSS 7.7, the advisory was revised on 2026-10-13, and exploitation in the wild is not mentioned.
- CVSS 7.7 SQL injection (CWE-89) in FortiMail webmail.
- Authenticated attackers can run unauthorized code or commands.
- Exploitation uses specifically crafted HTTP requests.
- PSIRT FG-IR-26-184 was revised on 2026-10-13; no active exploitation stated.
CVSSv3 Score: 7.7 An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] in FortiMail webmail may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests. Revised on 2026-10-13 00:00:00
This source does not provide full text. Read it at fortiguard.fortinet.com.