Unauthenticated FortiMail SQL injection can execute code or commands
Original title: Improper neutralization of special elements used in an SQL command
Fortinet rates the FortiMail flaw CVSS 9.4 and says crafted requests are enough, with no login required.
Fortinet PSIRT reports an SQL injection vulnerability in FortiMail that may let an unauthenticated attacker execute unauthorized code or commands through crafted requests. The issue is scored CVSS 8.8 wait no, the notice gives CVSS v3 9.4 and was revised on November 10. The snippet does not name versions, a fix, a CVE or known attacks.
Unconfirmed: Affected versions, a fix, a CVE and exploitation status are not stated.
- CVSS v3 score is 9.4.
- No authentication is required.
- Fortinet classifies the issue as CWE-89.
- The advisory was revised on November 10.
Impact: Unauthenticated code or command execution
| Product | Affected |
|---|---|
| Fortinet FortiMail | — |
From the original article
CVSSv3 Score: 9. 4 An Improper neutralization of special elements used in an SQL command ('SQL injection') [CWE-89] in FortiMail may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests. Revised on 2026-11-10 00:00:00
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.