This vulnerability in Fortinet FortiMail is due to improper neutralization of special elements in SQL commands, classified as an SQL Injection (CWE-89). It affects multiple versions of FortiMail, allowing an attacker with authenticated privileged access to execute unauthorized code or commands through crafted HTTP(S) requests. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vendor has released an official fix for this vulnerability.

Successful exploitation can lead to unauthorized code or command execution on affected FortiMail systems, potentially compromising confidentiality, integrity, and availability of the system. The attacker must have authenticated privileged access to exploit this vulnerability. There are no reports of active exploitation in the wild.

An official fix is available from Fortinet to remediate this vulnerability. It is recommended to apply the vendor-provided patches for FortiMail versions 7.2.x, 7.4.x, and 7.6.x as soon as possible. Since this is not a cloud service, administrators must manually update affected systems. No additional mitigation steps are indicated by the vendor advisory.