On October 13, 2026, Fortinet published security advisory FG-IR-26-184, disclosing an SQL injection vulnerability (CVE-2025-57739) in the web interface of the FortiMail email gateway. The vulnerability has a CVSSv3 score of 7.7 (High) and allows an authenticated attacker to execute unauthorized code or commands via specially crafted HTTP requests. Three FortiMail branches are affected — 7.2, 7.4, and 7.6; fixes are already available. Administrators of on‑premises installations should prioritize updating the software.
Technical details of the vulnerability
The vulnerability is classified as CWE-89 — improper neutralization of special elements used in an SQL command. According to the Fortinet advisory, the attack is carried out via the GUI component (FortiMail webmail) using specially crafted HTTP requests. The CVSS vector (according to the official CVE record: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network access with low attack complexity but with mandatory authentication. The impact is rated as high for all three parameters — confidentiality, integrity, and availability.
The key point: exploitation requires a webmail user account. This reduces the likelihood of large-scale automated attacks but does not eliminate the threat — compromised or weak email user credentials can become a starting point for privilege escalation.
According to the Fortinet advisory, the vulnerability was discovered internally by the company. At the time the advisory was published, no instances of active exploitation had been recorded.
Affected versions and fixes
According to the Fortinet advisory, the following FortiMail versions are affected:
- FortiMail 7.6: versions from 7.6.0 to 7.6.3 — update to 7.6.4 or later
- FortiMail 7.4: versions from 7.4.0 to 7.4.5 — update to 7.4.6 or later
- FortiMail 7.2: versions from 7.2.0 to 7.2.8 — update to 7.2.9 or later
FortiMail 8.0 is not affected by this vulnerability. For FortiMail Cloud users, Fortinet reports that the issue was already fixed in the first quarter of 2026 and no action is required from customers.
Impact assessment
FortiMail is widely used as a corporate email security gateway providing spam filtering, antivirus scanning, and phishing protection. An SQL injection in the webmail interface poses a serious threat: successful exploitation can lead to privilege escalation, which in the context of an email gateway means potential access to confidential correspondence and the ability to manipulate email policies.
It is worth noting that in October 2026 Fortinet disclosed several vulnerabilities in its products at once. Previously, we wrote about an authentication bypass in FortiSandbox with a CVSS score of 9.6 and about a critical FortiSIEM vulnerability with a CVSS score of 9.4. For organizations using multiple Fortinet products, it makes sense to conduct a comprehensive audit of the versions across the entire vendor infrastructure.
Recommendations
- Determine the FortiMail version you are using and compare it against the list of affected versions above.
- Update FortiMail to a fixed version of the corresponding branch (7.6.4, 7.4.6, or 7.2.9). If migrating to branch 8.0, which is not affected by the vulnerability, is possible, consider this option.
- Check webmail accounts: since exploitation requires authentication, make sure there are no compromised or unused accounts. Strengthen your password policies.
- FortiMail Cloud users do not need to take additional action — Fortinet reports that the fix has already been applied on the cloud service side.
Although Fortinet is not seeing active exploitation of CVE-2025-57739, the CVSS score of 7.7 and the possibility of privilege escalation make patching a priority. SQL injections remain one of the best-studied and easiest-to-automate classes of attacks — delaying patch installation increases risk as details of the vulnerability appear in the public domain. Schedule the FortiMail update for the next maintenance window.
