This vulnerability is an SQL injection flaw (CWE‑89) in Fortinet FortiMail version 7.2.0 through 7.2.8, 7.4.0 through 7.4.5, and 7.6.0 through 7.6.3. The flaw arises from improper neutralization of special elements in an SQL command, enabling an authenticated user with privileged access to send specially crafted HTTP or HTTPS requests that cause the back‑end database to execute arbitrary SQL. This can allow the attacker to run arbitrary code or commands on the FortiMail appliance, compromising confidentiality, integrity, and availability of email traffic and system data.

The affected products are Fortinet FortiMail appliance releases 7.2.0–7.2.8, 7.4.0–7.4.5, and 7.6.0–7.6.3. FortiMail Cloud customers are protected starting with version 25.2, which removes the flaw, so no remedial action is required for cloud deployments.

The CVSS score of 6.3 indicates a medium severity impact. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker possess authenticated privileged credentials, and the attack vector is network‑based, targeting HTTP or HTTPS endpoints. Because the flaw gives full code execution privileges on the appliance, the potential damage is high if credential credentials are compromised or mismanaged.