Fortinet Fortimail
47 CVEs affecting Fortinet Fortimail. Latest disclosed: 2026-05-12. Critical: 5, High: 12.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-32756 | Critical | 9.8 | 2025-05-13 | A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions, FortiCamera 1.1… |
CVE-2023-47539 | Critical | 9.8 | 2025-03-18 | An improper access control vulnerability in FortiMail version 7.4.0 configured with RADIUS authentication and remote_wildcard enabled may allow a remote unauth… |
CVE-2021-36166 | Critical | 9.8 | 2022-03-01 | An improper authentication vulnerability in FortiMail before 7.0.1 may allow a remote attacker to efficiently guess one administrative account's authentication… |
CVE-2021-24007 | Critical | 9.8 | 2021-07-09 | Multiple improper neutralization of special elements of SQL commands vulnerabilities in FortiMail before 6.4.4 may allow a non-authenticated attacker to execut… |
CVE-2020-9294 | Critical | 9.8 | 2020-04-27 | An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 and earlier and FortiVoiceEntreprise 6.0.0 and 6.0.1 may allow a remote unauthentica… |
CVE-2023-36556 | High | 8.8 | 2023-10-10 | An incorrect authorization vulnerability [CWE-863] in FortiMail webmail version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.5 and below 6.4.7 allows an auth… |
CVE-2021-24013 | High | 8.8 | 2021-07-12 | Multiple Path traversal vulnerabilities in the Webmail of FortiMail before 6.4.4 may allow a regular user to obtain unauthorized access to files and data via s… |
CVE-2021-22129 | High | 8.8 | 2021-07-09 | Multiple instances of incorrect calculation of buffer size in the Webmail and Administrative interface of FortiMail before 6.4.5 may allow an authenticated att… |
CVE-2022-27488 | High | 8.3 | 2023-12-13 | A cross-site request forgery (CSRF) in Fortinet FortiVoiceEnterprise version 6.4.x, 6.0.x, FortiSwitch version 7.0.0 through 7.0.4, 6.4.0 through 6.4.10, 6.2.0… |
CVE-2022-22299 | High | 7.8 | 2022-08-05 | A format string vulnerability [CWE-134] in the command line interpreter of FortiADC version 6.0.0 through 6.0.4, FortiADC version 6.1.0 through 6.1.5, FortiADC… |
CVE-2021-32586 | High | 7.7 | 2022-03-01 | An improper input validation vulnerability in the web server CGI facilities of FortiMail before 7.0.1 may allow an unauthenticated attacker to alter the enviro… |
CVE-2021-26091 | High | 7.5 | 2025-03-24 | A use of a cryptographically weak pseudo-random number generator vulnerability in the authenticator of the Identity Based Encryption service of FortiMail 6.4.0… |
CVE-2021-26095 | High | 7.5 | 2021-07-20 | The combination of various cryptographic issues in the session management of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6, including the encryption co… |
CVE-2021-24020 | High | 7.5 | 2021-07-09 | A missing cryptographic step in the implementation of the hash digest algorithm in FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 may allow an unauthen… |
CVE-2025-53681 | High | 7.2 | 2026-05-12 | An improper neutralization of special elements used in an SQL Command ("SQL Injection&") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 throu… |
CVE-2021-24015 | High | 7.2 | 2021-07-12 | An improper neutralization of special elements used in an OS Command vulnerability in the administrative interface of FortiMail before 6.4.4 may allow an authe… |
CVE-2019-15712 | High | 7.2 | 2020-01-23 | An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to access web console they s… |
CVE-2024-46663 | Medium | 6.7 | 2025-03-11 | A stack-buffer overflow vulnerability [CWE-121] in Fortinet FortiMail CLI version 7.6.0 through 7.6.1 and before 7.4.3 allows a privileged attacker to execute… |
CVE-2024-56497 | Medium | 6.7 | 2025-01-14 | An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiMail versions 7.2.0 through 7.2.4 and 7.0.0 thro… |
CVE-2021-36193 | Medium | 6.7 | 2022-02-02 | Multiple stack-based buffer overflows in the command line interpreter of FortiWeb before 6.4.2 may allow an authenticated attacker to achieve arbitrary code ex… |