Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-126263 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-12 |
| Vendor | Fortinet |
| Product | FortiMail |
| Vulnerability Type | SQL injection (CWE-89) |
| CVSS Score | 9.8 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
An improper neutralization of special elements used in an SQL command (‘SQL injection’) vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.4 and 7.4.0 through 7.4.6 may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted requests.
The vendor description mentions an authenticated attacker, although the published CVSS vector (PR:N) requires no privileges — assume the more cautious variant when assessing risk. Compromising the mail gateway gives access to the mail flowing through it.
Required Actions
- Update FortiMail to the version listed in Fortinet advisory FG-IR-26-277.
- Restrict access to the FortiMail administrative interface to the management network or a list of trusted addresses.
- Review FortiMail user and administrator accounts; remove unused ones and enforce strong passwords with MFA.
Who Is Affected?
The vulnerability affects Fortinet FortiMail 8.0.0–8.0.1, 7.6.0–7.6.4 and 7.4.0–7.4.6. FortiMail is an email security gateway, typically exposed to the internet (SMTP, webmail) and used by enterprises and public institutions.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-126263 vulnerability?
CVE-2026-126263 is an SQL injection flaw (CWE-89) in Fortinet FortiMail that allows code or command execution via crafted requests. CVSS score: 9.8.
Does exploiting CVE-2026-126263 require authentication?
According to the vendor description, yes — the attacker must be authenticated; the CVSS vector published by Fortinet, however, states PR:N.
How to protect against CVE-2026-126263?
Update FortiMail as per advisory FG-IR-26-277 and restrict access to the device interfaces.
Who is affected by CVE-2026-126263?
Organizations running FortiMail 7.4.0–7.4.6, 7.6.0–7.6.4 or 8.0.0–8.0.1.
