FO
Product
FortiMail
On CISA KEVExploited in the wild
48
CVEs
2
On KEV
9.8
Max CVSS
2
New 30D
Severity mix
Critical 8High 15Medium 22Low 0
Watch
Add FortiMail to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-104286 In wildKEV | 9.8 | Oct 1 | Fortinet FortiMail Path Traversal Vulnerability Affected: 8.0.0; 7.6.0 through 7.6.5; 7.4.0 through 7.4.6; 7.2.0 through 7.2.9; 7.0.0 through 7.0.9 |
| CVE-2025-32756 In wildKEV | 9.8 | May 13 | Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability Affected: 7.6.0 through 7.6.2; 7.4.0 through 7.4.4; 7.2.0 through 7.2.7; 7.0.0 through 7.0.8 |
| CVE-2023-47539 | 9.8 | Mar 18 | An improper access control vulnerability in FortiMail version 7.4.0 configured with RADIUS authentication and remote_wildcard enabled may allow a remote unauthenticated attacker… Affected: 7.4.0 |
| CVE-2021-32586 | 9.8 | Mar 1 | An improper input validation vulnerability in the web server CGI facilities of FortiMail before 7.0.1 may allow an unauthenticated attacker to alter the environment of the… Affected: through 5.4.12; 6.0.0 before 6.0.12; 6.2.0 before 6.2.8; 6.4.0 before 6.4.6; 7.0.0 |
| CVE-2021-36166 | 9.8 | Mar 1 | An improper authentication vulnerability in FortiMail before 7.0.1 may allow a remote attacker to efficiently guess one administrative account's authentication token by means of… Affected: through 5.4.12; 6.0.0 before 6.0.12; 6.2.0 before 6.2.8; 6.4.0 before 6.4.6; 7.0.0 |
| CVE-2021-24020 | 9.8 | Jul 9 | A missing cryptographic step in the implementation of the hash digest algorithm in FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 may allow an unauthenticated attacker to… Affected: 6.2.0 through 6.2.7; 6.4.0 before 6.4.5 |
| CVE-2021-24007 | 9.8 | Jul 9 | Multiple improper neutralization of special elements of SQL commands vulnerabilities in FortiMail before 6.4.4 may allow a non-authenticated attacker to execute unauthorized code… Affected: through 5.4.12; 5.6.1 before 6.0.11; 6.2.0 before 6.2.7; 6.4.0 before 6.4.4 |
| CVE-2020-9294 | 9.8 | Apr 27 | An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 and earlier and FortiVoiceEntreprise 6.0.0 and 6.0.1 may allow a remote unauthenticated attacker to… Affected: through 5.4.10; 6.0.0 through 6.0.7; 6.2.0 through 6.2.2 |
| CVE-2025-57739 | 8.8 | Oct 13 | An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail… Affected: 7.6.0 through 7.6.3; 7.4.0 through 7.4.5; 7.2.0 through 7.2.8 |
| CVE-2023-33302 | 8.8 | Mar 31 | A buffer copy without checking size of input ('classic buffer overflow') in Fortinet FortiMail webmail and administrative interface version 6.4.0 through 6.4.4 and before 6.2.6… Affected: 5.4.0 through 5.4.12; 6.0.0 before 6.0.11; 6.2.0 before 6.2.7; 6.4.0 before 6.4.5 |
| CVE-2022-27488 | 8.8 | Dec 13 | A cross-site request forgery (CSRF) in Fortinet FortiVoiceEnterprise version 6.4.x, 6.0.x, FortiSwitch version 7.0.0 through 7.0.4, 6.4.0 through 6.4.10, 6.2.0 through 6.2.7,… Affected: 6.0.0 through 6.0.12; 6.2.0 through 6.2.9; 6.4.0 through 6.4.6; 7.0.0 through 7.0.3 |
| CVE-2023-36556 | 8.8 | Oct 10 | An incorrect authorization vulnerability [CWE-863] in FortiMail webmail version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.5 and below 6.4.7 allows an authenticated attacker… Affected: 6.0.0 through 6.0.12; 6.2.0 through 6.2.9; 6.4.0 through 6.4.7; 7.0.0 through 7.0.5; 7.2.0; 7.2.1; +1 more |
| CVE-2021-26095 | 8.8 | Jul 20 | The combination of various cryptographic issues in the session management of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6, including the encryption construction of the… Affected: 6.2.0 through 6.2.6; 6.4.0 before 6.4.5 |
| CVE-2021-24015 | 8.8 | Jul 12 | An improper neutralization of special elements used in an OS Command vulnerability in the administrative interface of FortiMail before 6.4.4 may allow an authenticated attacker to… Affected: 5.4.0 through 5.4.12; 6.0.0 before 6.0.11; 6.2.0 before 6.2.7; 6.4.0 before 6.4.4 |
| CVE-2021-22129 | 8.8 | Jul 9 | Multiple instances of incorrect calculation of buffer size in the Webmail and Administrative interface of FortiMail before 6.4.5 may allow an authenticated attacker with regular… Affected: through 5.4.12; 5.6.1 before 6.0.11; 6.2.0 before 6.2.7; 6.4.0 before 6.4.5 |
| CVE-2022-26122 | 8.6 | Nov 2 | An insufficient verification of data authenticity vulnerability [CWE-345] in FortiClient, FortiMail and FortiOS AV engines version 6.2.168 and below and version 6.4.274 and below… Affected: 6.0.0 through 6.0.12; 6.2.0 through 6.2.9; 6.4.0 through 6.4.6; 7.0.0 through 7.0.2; 4.1.0 |
| CVE-2022-22299 | 7.8 | Aug 5 | A format string vulnerability [CWE-134] in the command line interpreter of FortiADC version 6.0.0 through 6.0.4, FortiADC version 6.1.0 through 6.1.5, FortiADC version 6.2.0… Affected: 6.4.0 through 6.4.5; 7.0.0 through 7.0.2 |
| CVE-2021-26091 | 7.5 | Mar 24 | A use of a cryptographically weak pseudo-random number generator vulnerability in the authenticator of the Identity Based Encryption service of FortiMail 6.4.0 through 6.4.4, and… Affected: 6.2.0 before 6.4.5 |
| CVE-2021-26090 | 7.5 | Jul 12 | A missing release of memory after its effective lifetime vulnerability in the Webmail of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6 may allow an unauthenticated remote… Affected: 6.2.0 through 6.2.6; 6.4.0 before 6.4.5 |
| CVE-2021-26100 | 7.5 | Jul 9 | A missing cryptographic step in the Identity-Based Encryption service of FortiMail before 7.0.0 may allow an unauthenticated attacker who intercepts the encrypted messages to… Affected: before 7.0.0 |
| CVE-2023-45582 | 7.3 | Nov 14 | An improper restriction of excessive authentication attempts vulnerability [CWE-307] in FortiMail webmail version 7.2.0 through 7.2.4, 7.0.0 through 7.0.6 and before 6.4.8 may… Affected: 6.2.0 through 6.2.9; 6.4.0 through 6.4.8; 7.0.0 through 7.0.6; 7.2.0 through 7.2.4; 7.4.0 |
| CVE-2025-53681 | 7.2 | May 12 | An improper neutralization of special elements used in an SQL Command ("SQL Injection&") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail… Affected: 7.6.0 through 7.6.3; 7.4.0 through 7.4.5; 7.2.0 through 7.2.8 |
| CVE-2019-15712 | 7.2 | Jan 23 | An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to access web console they should not be… Affected: through 5.4.10; 6.0.0 through 6.0.6; 6.2.0 |
| CVE-2024-46663 | 6.7 | Mar 11 | A stack-buffer overflow vulnerability [CWE-121] in Fortinet FortiMail CLI version 7.6.0 through 7.6.1 and before 7.4.3 allows a privileged attacker to execute arbitrary code or… Affected: 6.4.0 before 7.2.7; 7.4.0 before 7.4.4; 7.6.0 before 7.6.2 |
| CVE-2024-56497 | 6.7 | Jan 14 | An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiMail versions 7.2.0 through 7.2.4 and 7.0.0 through 7.0.6 and 6.4.0… Affected: 6.4.0 before 6.4.8; 7.0.0 before 7.0.7; 7.2.0 before 7.2.5 |
| CVE-2021-42757 | 6.7 | Dec 8 | A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to achieve arbitrary code… Affected: 5.4.0 through 6.2.7; 6.4.0 through 6.4.6; 7.0.0 through 7.0.2 |
| CVE-2022-39945 | 6.5 | Nov 2 | An improper access control vulnerability [CWE-284] in FortiMail 7.2.0, 7.0.0 through 7.0.3, 6.4 all versions, 6.2 all versions, 6.0 all versions may allow an authenticated admin… Affected: 6.0.0 through 6.0.12; 6.2.0 through 6.2.9; 6.4.0 through 6.4.7; 7.0.0 through 7.0.3; 7.2.0 |
| CVE-2021-24013 | 6.5 | Jul 12 | Multiple Path traversal vulnerabilities in the Webmail of FortiMail before 6.4.4 may allow a regular user to obtain unauthorized access to files and data via specifically crafted… Affected: 5.4.0 through 5.4.12; 6.0.0 before 6.0.11; 6.2.0 before 6.2.7; 6.4.0 before 6.4.4 |
| CVE-2022-23439 | 6.1 | Jan 22 | A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafted HTTP requests, where the `Host`… Affected: 6.4.0 before 7.0.4 |
| CVE-2022-26114 | 6.1 | Sep 6 | An improper neutralization of input during web page generation vulnerability [CWE-79] in the Webmail of FortiMail before 7.2.0 may allow an unauthenticated attacker to trigger a… Affected: before 7.2.0 |
| CVE-2021-43062 | 6.1 | Feb 2 | A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiMail version 7.0.1 and 7.0.0, version 6.4.5 and below, version 6.3.7 and… Affected: 6.2.0 before 6.2.8; 6.4.0 before 6.4.6; 7.0.0 before 7.0.2 |
| CVE-2017-7732 | 6.1 | Oct 26 | A reflected Cross-Site Scripting (XSS) vulnerability in Fortinet FortiMail 5.1 and earlier, 5.2.0 through 5.2.9, and 5.3.0 through 5.3.9 customized pre-authentication webmail… Affected: 4.1.0; 4.2.0; 4.3.0; 4.3.8; 5.0; 5.0.1; +30 more |
| CVE-2017-3125 | 6.1 | Apr 12 | An unauthenticated XSS vulnerability with FortiMail 5.0.0 - 5.2.9 and 5.3.0 - 5.3.8 could allow an attacker to execute arbitrary scripts in the security context of the browser of… Affected: 5.0; 5.0.5; 5.0.6; 5.0.7; 5.0.8; 5.0.9; +25 more |
| CVE-2023-36633 | 5.4 | Nov 14 | An improper authorization vulnerability [CWE-285] in FortiMail webmail version 7.2.0 through 7.2.2 and before 7.0.5 allows an authenticated attacker to see and modify the title of… Affected: 6.0.0 before 7.0.6; 7.2.0 before 7.2.3 |
| CVE-2023-36637 | 5.4 | Oct 10 | An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiMail version 7.2.0 through 7.2.2 and before 7.0.5 allows an authenticated attacker to… Affected: 7.0.1 through 7.0.5; 7.2.0; 7.2.1; 7.2.2 |
| CVE-2021-24008 | 5.3 | Mar 28 | An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiDDoS version 5.4.0, version 5.3.2 and below, version 5.2.0, version… Affected: 6.0.0 before 6.0.10; 6.2.0 before 6.2.5; 6.4.0 before 6.4.2 |
| CVE-2022-29056 | 5.3 | Mar 9 | A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiMail version 6.4.0, version 6.2.0 through 6.2.4 and before 6.0.9 allows a… Affected: 6.0.0 before 6.0.10; 6.2.1 before 6.2.5; 6.4.0 |
| CVE-2020-15933 | 5.3 | Jan 5 | A exposure of sensitive information to an unauthorized actor in Fortinet FortiMail versions 6.0.9 and below, FortiMail versions 6.2.4 and below FortiMail versions 6.4.1 and 6.4.0… Affected: through 6.0.9; 6.2.0; 6.2.1; 6.2.2; 6.2.3; 6.2.4; +2 more |
| CVE-2021-32591 | 5.3 | Dec 8 | A missing cryptographic steps vulnerability in the function that encrypts users' LDAP and RADIUS credentials in FortiSandbox before 4.0.1, FortiWeb before 6.3.12, FortiADC before… Affected: 5.0 through 5.6.3; 6.0.0 through 6.0.11; 6.2.0 through 6.2.7; 6.4.0 through 6.4.5; 7.0.0; 7.0.1 |
| CVE-2021-26099 | 4.9 | Jul 12 | Missing cryptographic steps in the Identity-Based Encryption service of FortiMail before 7.0.0 may allow an attacker who comes in possession of the encrypted master keys to… Affected: 5.0 before 7.0.0 |
| CVE-2019-15707 | 4.9 | Jan 23 | An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to perform system backup config download they… Affected: through 5.4.10; 6.0.0 through 6.0.6; 6.2.0 |
| CVE-2024-40588 | 4.4 | Aug 12 | Multiple relative path traversal vulnerabilities [CWE-23] vulnerability in Fortinet FortiCamera 2.1 all versions, FortiCamera 2.0.0, FortiCamera 1.1 all versions, FortiCamera 1.0… Affected: 6.4.0 before 7.4.4; 7.6.0 before 7.6.2 |
| CVE-2025-54972 | 4.3 | Nov 18 | An improper neutralization of crlf sequences ('crlf injection') vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 through 7.4.5, FortiMail 7.2 all versions,… Affected: 7.0.0 before 7.4.6; 7.6.0 before 7.6.4 |
| CVE-2024-47569 | 4.3 | Oct 14 | A insertion of sensitive information into sent data vulnerability in Fortinet FortiMail 7.4.0 through 7.4.2, FortiMail 7.2.0 through 7.2.6, FortiMail 7.0 all versions,… Affected: 7.4.0 through 7.4.2; 7.2.0 through 7.2.6; 7.0.0 through 7.0.9 |
| CVE-2025-55717 | 4.0 | Mar 10 | A cleartext storage of sensitive information vulnerability [CWE-312] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0 through 7.4.4, FortiMail 7.2.0… Affected: 7.0.0 before 7.0.9; 7.2.0 before 7.2.8; 7.4.0 before 7.4.5; 7.6.0 before 7.6.3 |
| CVE-2015-3293 | – | Apr 14 | FortiMail 5.0.3 through 5.2.3 allows remote administrators to obtain credentials via the "diag debug application httpd" command Affected: 5.0.3; 5.0.4; 5.0.5; 5.0.6; 5.0.7; 5.1; +8 more |
| CVE-2014-8617 | – | Mar 4 | Cross-site scripting (XSS) vulnerability in the Web Action Quarantine Release feature in the WebGUI in Fortinet FortiMail before 4.3.9, 5.0.x before 5.0.8, 5.1.x before 5.1.5, and… Affected: through 4.3.8; 5.0; 5.0.1; 5.0.2; 5.0.3; 5.0.4; +11 more |
| CVE-2013-1471 | – | Feb 4 | Multiple cross-site scripting (XSS) vulnerabilities in admin/FEAdmin.html in Fortinet FortiMail before 4.3.4 on FortiMail Identity-Based Encryption (IBE) appliances allow… Affected: through 4.0; 3.0; 3.0; 3.0; 3.0; 4.0; +2 more |
Showing 48