Fortimail (Fortinet) - vulnerabilities (CVEs)

49 CVEs, 2 in the last 30 days, 155 known versions, newest CVE from 2026-10-13. Vendor: Fortinet.

CVEs of Fortimail

CVE-2025-57739 - CVSS 8.8 (high), 2026-10-13: An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0…
CVE-2026-104286 - CVSS 9.8 (critical), 2026-10-01: An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0…
CVE-2025-53681 - CVSS 7.2 (high), 2026-05-12: An improper neutralization of special elements used in an SQL Command ("SQL Injection&") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0…
CVE-2025-55717 - CVSS 4 (medium), 2026-03-10: A cleartext storage of sensitive information vulnerability [CWE-312] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0 through 7.4.4,…
CVE-2025-54972 - CVSS 4.3 (medium), 2025-11-18: An improper neutralization of crlf sequences ('crlf injection') vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 through 7.4.5,…
CVE-2024-47569 - CVSS 4.3 (medium), 2025-10-14: A insertion of sensitive information into sent data vulnerability in Fortinet FortiMail 7.4.0 through 7.4.2, FortiMail 7.2.0 through 7.2.6, FortiMail 7.0 all…
CVE-2024-40588 - CVSS 4.4 (medium), 2025-08-12: Multiple relative path traversal vulnerabilities [CWE-23] vulnerability in Fortinet FortiCamera 2.1 all versions, FortiCamera 2.0.0, FortiCamera 1.1 all…
CVE-2025-32756 - CVSS 9.8 (critical), 2025-05-13: A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions, FortiCamera 1.1…
CVE-2023-33302 - CVSS 8.8 (high), 2025-03-31: A buffer copy without checking size of input ('classic buffer overflow') in Fortinet FortiMail webmail and administrative interface version 6.4.0 through…
CVE-2021-24008 - CVSS 5.3 (medium), 2025-03-28: An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiDDoS version 5.4.0, version 5.3.2 and below,…
CVE-2021-26091 - CVSS 7.5 (high), 2025-03-24: A use of a cryptographically weak pseudo-random number generator vulnerability in the authenticator of the Identity Based Encryption service of FortiMail…
CVE-2023-47539 - CVSS 9.8 (critical), 2025-03-18: An improper access control vulnerability in FortiMail version 7.4.0 configured with RADIUS authentication and remote_wildcard enabled may allow a remote…
CVE-2024-46663 - CVSS 6.7 (medium), 2025-03-11: A stack-buffer overflow vulnerability [CWE-121] in Fortinet FortiMail CLI version 7.6.0 through 7.6.1 and before 7.4.3 allows a privileged attacker to execute…
CVE-2022-23439 - CVSS 6.1 (medium), 2025-01-22: A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafted HTTP requests,…
CVE-2024-56497 - CVSS 6.7 (medium), 2025-01-14: An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiMail versions 7.2.0 through 7.2.4 and 7.0.0…
CVE-2022-27488 - CVSS 8.8 (high), 2023-12-13: A cross-site request forgery (CSRF) in Fortinet FortiVoiceEnterprise version 6.4.x, 6.0.x, FortiSwitch version 7.0.0 through 7.0.4, 6.4.0 through 6.4.10,…
CVE-2023-45582 - CVSS 7.3 (high), 2023-11-14: An improper restriction of excessive authentication attempts vulnerability [CWE-307] in FortiMail webmail version 7.2.0 through 7.2.4, 7.0.0 through 7.0.6 and…
CVE-2023-36633 - CVSS 5.4 (medium), 2023-11-14: An improper authorization vulnerability [CWE-285] in FortiMail webmail version 7.2.0 through 7.2.2 and before 7.0.5 allows an authenticated attacker to see…
CVE-2023-36637 - CVSS 5.4 (medium), 2023-10-10: An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiMail version 7.2.0 through 7.2.2 and before 7.0.5 allows an…
CVE-2023-36556 - CVSS 8.8 (high), 2023-10-10: An incorrect authorization vulnerability [CWE-863] in FortiMail webmail version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.5 and below 6.4.7 allows an…
CVE-2022-29056 - CVSS 5.3 (medium), 2023-03-09: A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiMail version 6.4.0, version 6.2.0 through 6.2.4 and…
CVE-2022-39945 - CVSS 6.5 (medium), 2022-11-02: An improper access control vulnerability [CWE-284] in FortiMail 7.2.0, 7.0.0 through 7.0.3, 6.4 all versions, 6.2 all versions, 6.0 all versions may allow an…
CVE-2022-26122 - CVSS 8.6 (high), 2022-11-02: An insufficient verification of data authenticity vulnerability [CWE-345] in FortiClient, FortiMail and FortiOS AV engines version 6.2.168 and below and…
CVE-2022-26114 - CVSS 6.1 (medium), 2022-09-06: An improper neutralization of input during web page generation vulnerability [CWE-79] in the Webmail of FortiMail before 7.2.0 may allow an unauthenticated…
CVE-2022-22299 - CVSS 7.8 (high), 2022-08-05: A format string vulnerability [CWE-134] in the command line interpreter of FortiADC version 6.0.0 through 6.0.4, FortiADC version 6.1.0 through 6.1.5,…
CVE-2021-32586 - CVSS 9.8 (critical), 2022-03-01: An improper input validation vulnerability in the web server CGI facilities of FortiMail before 7.0.1 may allow an unauthenticated attacker to alter the…
CVE-2021-36166 - CVSS 9.8 (critical), 2022-03-01: An improper authentication vulnerability in FortiMail before 7.0.1 may allow a remote attacker to efficiently guess one administrative account's…
CVE-2021-36193 - CVSS 7.2 (high), 2022-02-02: Multiple stack-based buffer overflows in the command line interpreter of FortiWeb before 6.4.2 may allow an authenticated attacker to achieve arbitrary code…
CVE-2021-43062 - CVSS 6.1 (medium), 2022-02-02: A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiMail version 7.0.1 and 7.0.0, version 6.4.5 and below,…
CVE-2020-15933 - CVSS 5.3 (medium), 2022-01-05: A exposure of sensitive information to an unauthorized actor in Fortinet FortiMail versions 6.0.9 and below, FortiMail versions 6.2.4 and below FortiMail…
CVE-2021-32591 - CVSS 5.3 (medium), 2021-12-08: A missing cryptographic steps vulnerability in the function that encrypts users' LDAP and RADIUS credentials in FortiSandbox before 4.0.1, FortiWeb before…
CVE-2021-42757 - CVSS 6.7 (medium), 2021-12-08: A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to…
CVE-2021-26095 - CVSS 8.8 (high), 2021-07-20: The combination of various cryptographic issues in the session management of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6, including the encryption…
CVE-2021-24015 - CVSS 8.8 (high), 2021-07-12: An improper neutralization of special elements used in an OS Command vulnerability in the administrative interface of FortiMail before 6.4.4 may allow an…
CVE-2021-24013 - CVSS 8.8 (high), 2021-07-12: Multiple Path traversal vulnerabilities in the Webmail of FortiMail before 6.4.4 may allow a regular user to obtain unauthorized access to files and data via…
CVE-2021-26090 - CVSS 7.5 (high), 2021-07-12: A missing release of memory after its effective lifetime vulnerability in the Webmail of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6 may allow an…
CVE-2021-26099 - CVSS 4.9 (medium), 2021-07-12: Missing cryptographic steps in the Identity-Based Encryption service of FortiMail before 7.0.0 may allow an attacker who comes in possession of the encrypted…
CVE-2021-24020 - CVSS 9.8 (critical), 2021-07-09: A missing cryptographic step in the implementation of the hash digest algorithm in FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 may allow an…
CVE-2021-24007 - CVSS 9.8 (critical), 2021-07-09: Multiple improper neutralization of special elements of SQL commands vulnerabilities in FortiMail before 6.4.4 may allow a non-authenticated attacker to…
CVE-2021-22129 - CVSS 8.8 (high), 2021-07-09: Multiple instances of incorrect calculation of buffer size in the Webmail and Administrative interface of FortiMail before 6.4.5 may allow an authenticated…
CVE-2021-26100 - CVSS 7.5 (high), 2021-07-09: A missing cryptographic step in the Identity-Based Encryption service of FortiMail before 7.0.0 may allow an unauthenticated attacker who intercepts the…
CVE-2020-9294 - CVSS 9.8 (critical), 2020-04-27: An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 and earlier and FortiVoiceEntreprise 6.0.0 and 6.0.1 may allow a remote…
CVE-2019-15712 - CVSS 7.2 (high), 2020-01-23: An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to access web console they…
CVE-2019-15707 - CVSS 4.9 (medium), 2020-01-23: An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to perform system backup…
CVE-2017-7732 - CVSS 6.1 (medium), 2017-10-26: A reflected Cross-Site Scripting (XSS) vulnerability in Fortinet FortiMail 5.1 and earlier, 5.2.0 through 5.2.9, and 5.3.0 through 5.3.9 customized…
CVE-2017-3125 - CVSS 6.1 (medium), 2017-04-12: An unauthenticated XSS vulnerability with FortiMail 5.0.0 - 5.2.9 and 5.3.0 - 5.3.8 could allow an attacker to execute arbitrary scripts in the security…
CVE-2015-3293 - CVSS 4 (medium), 2015-04-14: FortiMail 5.0.3 through 5.2.3 allows remote administrators to obtain credentials via the "diag debug application httpd" command.
CVE-2014-8617 - CVSS 4.3 (medium), 2015-03-04: Cross-site scripting (XSS) vulnerability in the Web Action Quarantine Release feature in the WebGUI in Fortinet FortiMail before 4.3.9, 5.0.x before 5.0.8,…
CVE-2013-1471 - CVSS 4.3 (medium), 2013-02-04: Multiple cross-site scripting (XSS) vulnerabilities in admin/FEAdmin.html in Fortinet FortiMail before 4.3.4 on FortiMail Identity-Based Encryption (IBE)…