[ CVE-2025-57739 · Published 13 Oct 2026 ]

Vulnerability in Fortinet FortiMail

CVSS 8.8 EPSS <1%1 agency advisoryNo fix listed yet

[ Description ]Official description

An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 through 7.4.5, FortiMail 7.2.0 through 7.2.8 allows an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP or HTTPS requests.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

BSI CERT-Bund13 Oct 2026WID-SEC-2026-3929

Fortinet FortiMail: Vulnerability allows code execution Translated from German
CVE-2025-57739

[ References ]References

fortiguard.fortinet.com/psirt/FG-IR-26-184

[ Description ]Official description

[ Fixes ]Fixes and patches

[ Advisories ]Government CERT advisories

Fortinet FortiMail: Vulnerability allows code execution Translated from German

[ References ]References