FO
Product
FortiMail
On CISA KEVExploited in the wild
48
CVEs
2
On KEV
9.8
Max CVSS
2
New 30D
Severity mix
Critical 8High 15Medium 22Low 0
Watch
Add FortiMail to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-57739 | 8.8 | Oct 13 | An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail… Affected: 7.6.0 through 7.6.3; 7.4.0 through 7.4.5; 7.2.0 through 7.2.8 |
| CVE-2023-33302 | 8.8 | Mar 31 | A buffer copy without checking size of input ('classic buffer overflow') in Fortinet FortiMail webmail and administrative interface version 6.4.0 through 6.4.4 and before 6.2.6… Affected: 6.4.0 through 6.4.4; 6.2.0 through 6.2.6; 6.0.0 through 6.0.10; 5.4.0 through 5.4.12; 5.3.12 through 5.3.13; 5.3.0 through 5.3.10; +3 more |
| CVE-2022-27488 | 8.8 | Dec 13 | A cross-site request forgery (CSRF) in Fortinet FortiVoiceEnterprise version 6.4.x, 6.0.x, FortiSwitch version 7.0.0 through 7.0.4, 6.4.0 through 6.4.10, 6.2.0 through 6.2.7,… Affected: 6.0.0 through 6.0.12; 6.2.0 through 6.2.9; 6.4.0 through 6.4.6; 7.0.0 through 7.0.3 |
| CVE-2023-36556 | 8.8 | Oct 10 | An incorrect authorization vulnerability [CWE-863] in FortiMail webmail version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.5 and below 6.4.7 allows an authenticated attacker… Affected: 6.0.0 through 6.0.12; 6.2.0 through 6.2.9; 6.4.0 through 6.4.7; 7.0.0 through 7.0.5; 7.2.0; 7.2.1; +1 more |
| CVE-2021-26095 | 8.8 | Jul 20 | The combination of various cryptographic issues in the session management of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6, including the encryption construction of the… Affected: 6.2.0 through 6.2.6; 6.4.0 before 6.4.5 |
| CVE-2021-24015 | 8.8 | Jul 12 | An improper neutralization of special elements used in an OS Command vulnerability in the administrative interface of FortiMail before 6.4.4 may allow an authenticated attacker to… Affected: 5.4.0 through 5.4.12; 6.0.0 before 6.0.11; 6.2.0 before 6.2.7; 6.4.0 before 6.4.4 |
| CVE-2021-22129 | 8.8 | Jul 9 | Multiple instances of incorrect calculation of buffer size in the Webmail and Administrative interface of FortiMail before 6.4.5 may allow an authenticated attacker with regular… Affected: through 5.4.12; 5.6.1 before 6.0.11; 6.2.0 before 6.2.7; 6.4.0 before 6.4.5 |
| CVE-2022-26122 | 8.6 | Nov 2 | An insufficient verification of data authenticity vulnerability [CWE-345] in FortiClient, FortiMail and FortiOS AV engines version 6.2.168 and below and version 6.4.274 and below… Affected: 6.0.0 through 6.0.12; 6.2.0 through 6.2.9; 6.4.0 through 6.4.6; 7.0.0 through 7.0.2; 4.1.0 |
| CVE-2022-22299 | 7.8 | Aug 5 | A format string vulnerability [CWE-134] in the command line interpreter of FortiADC version 6.0.0 through 6.0.4, FortiADC version 6.1.0 through 6.1.5, FortiADC version 6.2.0… Affected: 6.4.0 through 6.4.5; 7.0.0 through 7.0.2 |
| CVE-2021-26091 | 7.5 | Mar 24 | A use of a cryptographically weak pseudo-random number generator vulnerability in the authenticator of the Identity Based Encryption service of FortiMail 6.4.0 through 6.4.4, and… Affected: 6.4.0 through 6.4.4; 6.2.0 through 6.2.9; 6.2.0 before 6.2.* |
| CVE-2021-26090 | 7.5 | Jul 12 | A missing release of memory after its effective lifetime vulnerability in the Webmail of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6 may allow an unauthenticated remote… Affected: 6.2.0 through 6.2.6; 6.4.0 before 6.4.5 |
| CVE-2021-26100 | 7.5 | Jul 9 | A missing cryptographic step in the Identity-Based Encryption service of FortiMail before 7.0.0 may allow an unauthenticated attacker who intercepts the encrypted messages to… Affected: before 7.0.0 |
| CVE-2023-45582 | 7.3 | Nov 14 | An improper restriction of excessive authentication attempts vulnerability [CWE-307] in FortiMail webmail version 7.2.0 through 7.2.4, 7.0.0 through 7.0.6 and before 6.4.8 may… Affected: 6.2.0 through 6.2.9; 6.4.0 through 6.4.8; 7.0.0 through 7.0.6; 7.2.0 through 7.2.4; 7.4.0 |
| CVE-2025-53681 | 7.2 | May 12 | An improper neutralization of special elements used in an SQL Command ("SQL Injection&") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail… Affected: 7.6.0 through 7.6.3; 7.4.0 through 7.4.5; 7.2.0 through 7.2.8 |
| CVE-2019-15712 | 7.2 | Jan 23 | An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to access web console they should not be… Affected: through 5.4.10; 6.0.0 through 6.0.6; 6.2.0 |
Showing 15