Loading story…
Fortinet disclosed CVE-2025-53681, an SQL injection flaw in the FortiMail administrative portal that could let an authenticated, privileged attacker execute unauthorized code or commands on the email gateway through crafted HTTP or HTTPS requests. The vulnerability stems from improper neutralization of special elements in SQL commands (CWE-89) within the admin GUI, and Fortinet said it was discovered internally by Jaguar Perlas of the Fortinet Burnaby InfoSec team.
Affected versions are FortiMail 7.6.0 through 7.6.3, 7.4.0 through 7.4.5, and 7.2.0 through 7.2.8. Fortinet advised customers to upgrade to 7.6.4, 7.4.6, or 7.2.9 and later, while FortiMail 8.0 is not affected. Fortinet rated the issue Medium with a CVSS v3 score of 6.3, while the NVD scored it 7.2; Fortinet said it had no evidence of in-the-wild exploitation at the time of disclosure.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
Fortinet published a PSIRT advisory for CVE-2025-53681, an authenticated SQL injection vulnerability in the FortiMail administrative portal that could allow a privileged attacker to execute unauthorized code or commands via crafted HTTP or HTTPS requests. The advisory identified affected versions and directed customers to upgrade to FortiMail 7.6.4, 7.4.6, or 7.2.9, while noting FortiMail 8.0 is not affected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fortinet disclosed **CVE-2026-104286**, a critical CVSS 9.8 zero-day in the FortiMail management interface that is under active exploitation. The path-traversal and improper null-byte-neutralization flaw allows an unauthenticated remote attacker to send crafted HTTP or HTTPS requests that write arbitrary files to the underlying appliance, potentially enabling code execution, command execution, system compromise, or service disruption. Affected versions are FortiMail 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8, and 7.2.0–7.2.9; fixes for most affected branches were not yet available when the advisory was issued. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog and required U.S. federal civilian agencies to perform forensic triage and mitigate it by October 4, 2026, although no known ransomware use was identified. Organizations should identify exposed FortiMail appliances, immediately restrict management-interface access to trusted private networks, disable Identity-Based Encryption (IBE) support where feasible, apply fixed releases as they become available, and review Fortinet-provided file, IP, and log indicators for evidence of compromise.
Oct 2, 2026
Fortinet issued a critical advisory for *FortiClient Enterprise Management Server (EMS)* warning that **CVE-2026-21643** enables **unauthenticated remote code execution** via an **SQL injection** flaw (`CWE-89`) in the product’s **GUI/web interface**. By sending specially crafted HTTP requests that exploit insufficient input sanitization, an external attacker could execute arbitrary code or unauthorized commands on the EMS server without valid credentials, potentially turning a central endpoint-management platform into a foothold for broader compromise. The issue is reported as affecting the **7.4** line, with **FortiClientEMS 7.4.4** explicitly called out as vulnerable; Fortinet’s recommended remediation is to **upgrade to 7.4.5 or later**. Fortinet also stated that the **8.0** and **7.2** branches are **not affected**, and an updated note indicated **FortiEMS Cloud/SaaS instances are not impacted**, narrowing immediate exposure primarily to on-prem deployments running the affected version.
Jun 29, 2026
Fortinet disclosed two high-severity vulnerabilities affecting **FortiSandbox** and **FortiDDoS-F**, both of which could allow unauthorized code or command execution. **CVE-2026-39808** is an OS command injection flaw in FortiSandbox versions `4.4.0` through `4.4.8`, mapped to `CWE-78`, with a `CVSS 3.1` vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, indicating remote exploitation without authentication and high impact across confidentiality, integrity, and availability. Fortinet also disclosed **CVE-2026-39815**, an SQL injection vulnerability in FortiDDoS-F versions `7.2.1` through `7.2.2`, mapped to `CWE-89`. The flaw requires low privileges but may likewise enable unauthorized code or command execution, and carries a `CVSS 3.1` vector of `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`. The issues are tracked in Fortinet advisories **FG-IR-26-100** and **FG-IR-26-119**, respectively, expanding the vendor's latest set of appliance security fixes.
Jun 29, 2026