Field brief
Fortinet FortiMail SQL Injection CVE‑2026‑126263 Remains Unpatched
A critical SQL injection flaw in Fortinet FortiMail, published on 11 Nov 2026, has no available fix and no known exploitation yet.
Fortinet’s FortiMail 8.0.0‑8.0.1, 7.6.0‑7.6.4, and 7.4.0‑7.4.6 are vulnerable to a critical SQL injection (CVE‑2026‑126263). NVD lists a 9.8 CVSS score, but no patch has been released and the vulnerability is not in CISA’s KEV catalog. With no public exploit yet, the risk is theoretical, yet the high severity warrants vigilance. Monitor Fortinet’s FortiGuard portal for a fix and apply it promptly when available. In the meantime, review FortiMail configuration to limit exposed interfaces and enforce strict authentication. This scenario underscores the need for proactive monitoring and configuration hardening. Stakeholders should keep an eye on Fortinet’s release notes and update schedules. If a patch appears, implement it immediately and verify configuration changes. The lack of a patch and absence of known exploitation mean the risk is theoretical, but the high severity score demands vigilance. Continuous vulnerability assessment and timely patch management remain essential. CVE‑2026‑126263: Fortinet FortiMail SQL Injection | CVETodo
See what applies to your environment.
Use the Ncerio CVE feed to move from general intelligence to affected products.