An improper neutralization of special elements used in an SQL Command (CWE‑89) allows an attacker who has valid credentials on Fortinet FortiMail to submit crafted HTTP or HTTPS requests. The flaw lets the attacker inject arbitrary SQL statements that can modify, read, or delete data, thereby facilitating unauthorized code or command execution. The impact is a clear breach of confidentiality, integrity, and potentially availability of the device and its email data because the attacker can tamper with the database used to process mail flows.

This vulnerability affects FortiMail software versions 7.2.0 through 7.2.8, 7.4.0 through 7.4.5, and 7.6.0 through 7.6.3. FortiMail customers running any of these releases are at risk of the described injection attack.

The CVSS score of 7.7 reflects the high risk of the vulnerability when the attacker is authenticated. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog, indicating that it is not a known exploited vulnerability as of this analysis. The likely attack vector is a network‑based authenticated session; an attacker must first authenticate with legitimate user credentials before sending malicious requests. No additional exploitation prerequisites are described beyond authentication and the ability to send HTTP or HTTPS traffic to the device.