CVE-2025-57739

Published Oct 13, 2026

Last updated 3 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-57739 is an SQL injection vulnerability (CWE-89) affecting the webmail component of Fortinet's FortiMail secure email gateway. The flaw stems from the improper neutralization of special elements within SQL commands. An authenticated attacker can exploit this vulnerability by sending specifically crafted HTTP or HTTPS requests to the system, which can allow them to execute unauthorized code or commands and escalate their privileges. The vulnerability affects FortiMail versions 7.6.0 through 7.6.3, 7.4.0 through 7.4.5, and 7.2.0 through 7.2.8. Fortinet has addressed the issue by releasing patches, advising users to upgrade to versions 7.6.4, 7.4.6, or 7.2.9 and above, respectively. Additionally, Fortinet remediated the vulnerability for FortiMail Cloud customers, meaning no manual action is required for those on the cloud platform.

Description: An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 through 7.4.5, FortiMail 7.2.0 through 7.2.8 allows an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP or HTTPS requests.
Source: psirt@fortinet.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

psirt@fortinet.com: CWE-89

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 2

References