FortiMail CVE-2025-57739

Requires a valid authenticated session to the FortiMail management/webmail web interface (PR:L - a low-privilege account suffices, not necessarily admin), and network reachability to that HTTP/HTTPS interface. The attacker must be able to submit specifically crafted HTTP or HTTPS requests to the vulnerable endpoint. Exploitation is limited to the affected branches FortiMail 7.6.0-7.6.3, 7.4.0-7.4.5, and 7.2.0-7.2.8; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The principal limiting factor is the credential requirement - anonymous/unauthenticated exploitation is not supported - so exposure is greatest where the web interface is internet-facing and lower-tier accounts exist.

This is a credible priority for FortiMail operators, though not the top tier of emergency patching. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity attack requiring only low-level authentication and no user interaction, yielding full confidentiality, integrity, and availability impact - consistent with an authenticated SQL injection (CWE-89) that escalates to code/command execution. The requirement for valid credentials (PR:L) is the key mitigating signal: it rules out purely anonymous mass exploitation and pushes this toward authenticated-user or post-compromise scenarios. No EPSS score, CISA KEV listing, SSVC decision data, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the 8.8 is a severity signal, not an exploitation signal. Net: treat as a high-severity but not confirmed-exploited issue; prioritize patching for internet-exposed FortiMail management/webmail interfaces where lower-privileged accounts exist.

An attacker holding valid but low-privilege FortiMail credentials (or who has phished/obtained such an account) sends specially crafted HTTP/HTTPS requests to the FortiMail web interface, injecting SQL that the backend fails to neutralize. Because the flaw allows execution of unauthorized code or commands, the attacker pivots from limited access to full control over the appliance's data and operation. No public proof-of-concept was provided, and exploitation requires prior authentication, raising the practical bar.