CVE-2025-57739: 
Fortimail 脆弱性の分析と軽減

CVE-2025-57739 is a SQL injection vulnerability (CWE-89) in Fortinet FortiMail's webmail component that allows authenticated attackers to execute unauthorized code or commands via specially crafted HTTP or HTTPS requests. It affects FortiMail versions 7.2.0 through 7.2.8, 7.4.0 through 7.4.5, and 7.6.0 through 7.6.3; FortiMail 8.0 is not affected. The vulnerability was internally discovered by Jaguar Perlas of Fortinet's Burnaby Infosec team and publicly disclosed on October 13, 2026. It carries a CVSS v3.1 base score of 8.8 (High) per NVD, and 7.7 (High) per Fortinet's own advisory (FortiGuard Advisory, GitHub Advisory).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and resides in the FortiMail webmail GUI component. An authenticated attacker with low privileges can send specially crafted HTTP or HTTPS requests containing malicious SQL syntax that is not properly sanitized before being incorporated into SQL queries, enabling command execution on the underlying system. The attack vector is network-based, requires no user interaction, and has low attack complexity, making it straightforward to exploit once authentication is obtained. The vulnerability was internally reported and no public proof-of-concept code has been identified (FortiGuard Advisory, GitHub Advisory).

Successful exploitation allows an authenticated attacker to execute arbitrary code or commands on the FortiMail system, resulting in high impact to confidentiality, integrity, and availability. An attacker could read sensitive email data and system configurations, modify system settings or data, and disrupt mail service availability. Fortinet classifies the impact as "Escalation of Privilege," meaning a low-privileged authenticated user could gain elevated control over the FortiMail appliance (FortiGuard Advisory).

There is no evidence of active in-the-wild exploitation, and no public proof-of-concept exploit code is known to exist at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and Fortinet's advisory confirms it has not been exploited in the wild. The EPSS score is reported as 0.0, reflecting low current exploitation probability. Exploitation requires valid credentials (low-privilege authentication), which somewhat limits the attack surface compared to unauthenticated vulnerabilities (FortiGuard Advisory, GitHub Advisory).

Fortinet has released patched versions to address this vulnerability. Users should upgrade to the following fixed releases:

• FortiMail 7.2.x: Upgrade to 7.2.9 or above
• FortiMail 7.4.x: Upgrade to 7.4.6 or above
• FortiMail 7.6.x: Upgrade to 7.6.4 or above
• FortiMail 8.0: Not affected

Fortinet has also remediated this issue in FortiMail Cloud as of Q1 2026, requiring no action from cloud customers. As interim mitigations, restrict network access to FortiMail administrative and webmail interfaces, apply the principle of least privilege to user accounts, and consider deploying WAF rules to detect SQL injection patterns in HTTP/HTTPS traffic (FortiGuard Advisory).

Coverage of this vulnerability has been limited to standard vulnerability tracking and aggregation sites. Security news outlet SecurityOnline.info included it in a roundup of Fortinet vulnerabilities. No notable independent researcher commentary or significant community discussion has been identified beyond routine disclosure tracking (FortiGuard Advisory).