Vulnerability in Fortinet Fortimail
CVE-2025-54972
An improper neutralization of crlf sequences ('crlf injection') vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 through 7.4.5, FortiMail 7.2 all versions, FortiMail 7.0 all versions may allow an attacker to inject…
Vulnerability class: CRLF Injection
EPSS: 0.000 (8.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.9 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C.
Affected products
- Fortinet Fortimail — versions 7.6.0, 7.4.0, 7.2.0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-54972?
- CVE-2025-54972 is a low-severity vulnerability in Fortinet Fortimail, classified under CRLF Injection. CVSS score: 3.9/10. Published 2025-11-18.
- How severe is CVE-2025-54972?
- Low severity. CVSS v3 base score is 3.9 out of 10.