# Fortinet FortiMail.

Every CVE that names Fortinet FortiMail among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [SQL injection in Fortinet FortiMail](https://agentprime.io/advisories/CVE-2025-57739.md)
  `CVE-2025-57739` · CVE record: Fortinet FortiMail · CVSS 7.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: SQL injection
- [Path traversal in Fortinet FortiMail](https://agentprime.io/advisories/CVE-2026-104286.md)
  `CVE-2026-104286` · CVE record: Fortinet FortiMail · CVSS 9.8 Critical · Critical (KEV, CVSS 9+) · In CISA KEV · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal
- [SQL injection in Fortinet FortiMail](https://agentprime.io/advisories/CVE-2025-53681.md)
  `CVE-2025-53681` · CVE record: Fortinet FortiMail · CVSS 6.3 Medium · Not analysed yet · Published 12 May 2026 · Tags: SQL injection
- [Cleartext storage of sensitive information in Fortinet FortiVoice and others](https://agentprime.io/advisories/CVE-2025-55717.md)
  `CVE-2025-55717` · CVE record: Fortinet FortiVoice and 2 more · CVSS 3.8 Low · Not analysed yet · Published 10 Mar 2026 · Tags: Information disclosure
- [CRLF injection in Fortinet FortiMail](https://agentprime.io/advisories/CVE-2025-54972.md)
  `CVE-2025-54972` · CVE record: Fortinet FortiMail · CVSS 3.9 Low · Not analysed yet · Published 18 Nov 2025 · Tags: Other injection
- [Information disclosure in Fortinet FortiManager and others](https://agentprime.io/advisories/CVE-2024-47569.md)
  `CVE-2024-47569` · CVE record: Fortinet FortiManager and 4 more · CVSS 4.2 Medium · Not analysed yet · Published 14 Oct 2025 · Tags: Information disclosure
- [Path traversal in Fortinet FortiCamera and others](https://agentprime.io/advisories/CVE-2024-40588.md)
  `CVE-2024-40588` · CVE record: Fortinet FortiCamera and 4 more · CVSS 4.2 Medium · Not analysed yet · Published 12 Aug 2025 · Tags: Path traversal
- [Stack-based buffer overflow in Fortinet FortiNDR and others](https://agentprime.io/advisories/CVE-2025-32756.md)
  `CVE-2025-32756` · CVE record: Fortinet FortiNDR and 4 more · CVSS 9.6 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.31 · Not analysed yet · Published 13 May 2025 · Tags: Memory corruption
- [Buffer overflow in Fortinet FortiNDR and others](https://agentprime.io/advisories/CVE-2023-33302.md)
  `CVE-2023-33302` · CVE record: Fortinet FortiNDR and 1 more · CVSS 4.5 Medium · Not analysed yet · Published 31 Mar 2025 · Tags: Memory corruption
- [Weak random number generator in Fortinet FortiMail](https://agentprime.io/advisories/CVE-2021-26091.md)
  `CVE-2021-26091` · CVE record: Fortinet FortiMail · CVSS 6.9 Medium · Not analysed yet · Published 24 Mar 2025 · Tags: Weak cryptography or TLS
- [Improper access control in Fortinet FortiMail](https://agentprime.io/advisories/CVE-2023-47539.md)
  `CVE-2023-47539` · CVE record: Fortinet FortiMail · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Mar 2025 · Tags: Broken access control
- [Stack-based buffer overflow in Fortinet FortiMail](https://agentprime.io/advisories/CVE-2024-46663.md)
  `CVE-2024-46663` · CVE record: Fortinet FortiMail · CVSS 6.5 Medium · Not analysed yet · Published 11 Mar 2025 · Tags: Memory corruption
- [A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafted HTTP requests, where the \`Host\` header points to an arbitr…](https://agentprime.io/advisories/CVE-2022-23439.md)
  `CVE-2022-23439` · CVE record: Fortinet FortiTester and 4 more · CVSS 4.1 Medium · Not analysed yet · Published 22 Jan 2025 · Tags: CWE-610
- [OS command injection in Fortinet FortiMail and others](https://agentprime.io/advisories/CVE-2024-56497.md)
  `CVE-2024-56497` · CVE record: Fortinet FortiMail and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 14 Jan 2025 · Tags: Command injection
- [Cross-site request forgery in Fortinet FortiVoice and others](https://agentprime.io/advisories/CVE-2022-27488.md)
  `CVE-2022-27488` · CVE record: Fortinet FortiVoice and 4 more · CVSS 7.5 High · Not analysed yet · Published 13 Dec 2023 · Tags: Cross-site request forgery (CSRF)
- [Improper authorization in Fortinet FortiMail](https://agentprime.io/advisories/CVE-2023-36633.md)
  `CVE-2023-36633` · CVE record: Fortinet FortiMail · CVSS 5.3 Medium · Not analysed yet · Published 14 Nov 2023 · Tags: Broken access control
- [Unlimited authentication attempts in Fortinet FortiMail](https://agentprime.io/advisories/CVE-2023-45582.md)
  `CVE-2023-45582` · CVE record: Fortinet FortiMail · CVSS 5.3 Medium · Not analysed yet · Published 14 Nov 2023 · Tags: Authentication bypass
- [Cross-site scripting in Fortinet FortiMail](https://agentprime.io/advisories/CVE-2023-36637.md)
  `CVE-2023-36637` · CVE record: Fortinet FortiMail · CVSS 3.4 Low · Not analysed yet · Published 10 Oct 2023 · Tags: Cross-site scripting (XSS)
- [Incorrect authorization in Fortinet FortiMail](https://agentprime.io/advisories/CVE-2023-36556.md)
  `CVE-2023-36556` · CVE record: Fortinet FortiMail · CVSS 8.6 High · Not analysed yet · Published 10 Oct 2023 · Tags: Broken access control
- [Unlimited authentication attempts in Fortinet FortiMail](https://agentprime.io/advisories/CVE-2022-29056.md)
  `CVE-2022-29056` · CVE record: Fortinet FortiMail · CVSS 3.5 Low · Not analysed yet · Published 9 Mar 2023 · Tags: Authentication bypass
- [An improper access control vulnerability \[CWE-284\] in FortiMail 7.2.0, 7.0.0 through 7.0.3, 6.4 all versions, 6.2 all versions, 6.0 all versions may allow an authenticated admin user assigned to a sp…](https://agentprime.io/advisories/CVE-2022-39945.md)
  `CVE-2022-39945` · CVE record: Fortinet Fortinet FortiMail · CVSS 5.4 Medium · Not analysed yet · Published 2 Nov 2022
- [An improper neutralization of input during web page generation vulnerability \[CWE-79\] in the Webmail of FortiMail before 7.2.0 may allow an unauthenticated attacker to trigger a cross-site scripting…](https://agentprime.io/advisories/CVE-2022-26114.md)
  `CVE-2022-26114` · CVE record: Fortinet Fortinet FortiMail · CVSS 5.4 Medium · Not analysed yet · Published 6 Sept 2022
- [An improper input validation vulnerability in the web server CGI facilities of FortiMail before 7.0.1 may allow an unauthenticated attacker to alter the environment of the underlying script interpret…](https://agentprime.io/advisories/CVE-2021-32586.md)
  `CVE-2021-32586` · CVE record: Fortinet Fortinet FortiMail · CVSS 7.7 High · Not analysed yet · Published 1 Mar 2022
- [An improper authentication vulnerability in FortiMail before 7.0.1 may allow a remote attacker to efficiently guess one administrative account's authentication token by means of the observation of ce…](https://agentprime.io/advisories/CVE-2021-36166.md)
  `CVE-2021-36166` · CVE record: Fortinet Fortinet FortiMail · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Mar 2022
- [Stack-based buffer overflow in Fortinet FortiFone and others](https://agentprime.io/advisories/CVE-2021-36193.md)
  `CVE-2021-36193` · CVE record: Fortinet FortiFone and 4 more · CVSS 6.3 Medium · Not analysed yet · Published 2 Feb 2022 · Tags: Memory corruption
- [Fortinet FortiMail: A improper neutralization of input during web page generation ('cross-site scripting') in…](https://agentprime.io/advisories/CVE-2021-43062.md)
  `CVE-2021-43062` · CVE record: Fortinet Fortinet FortiMail · CVSS 6.1 Medium · EPSS 0.13 · Not analysed yet · Published 2 Feb 2022
- [Fortinet FortiMail: A exposure of sensitive information to an unauthorized actor in Fortinet FortiMail…](https://agentprime.io/advisories/CVE-2020-15933.md)
  `CVE-2020-15933` · CVE record: Fortinet Fortinet FortiMail · CVSS 5.3 Medium · Not analysed yet · Published 5 Jan 2022
- [Buffer overflow in Fortinet FortiOS and others](https://agentprime.io/advisories/CVE-2021-42757.md)
  `CVE-2021-42757` · CVE record: Fortinet FortiOS and 4 more · CVSS 6.3 Medium · Not analysed yet · Published 8 Dec 2021 · Tags: Memory corruption
- [The combination of various cryptographic issues in the session management of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6, including the encryption construction of the session cookie, may al…](https://agentprime.io/advisories/CVE-2021-26095.md)
  `CVE-2021-26095` · CVE record: Fortinet Fortinet FortiMail · CVSS 7.5 High · Not analysed yet · Published 20 Jul 2021
- [Multiple Path traversal vulnerabilities in the Webmail of FortiMail before 6.4.4 may allow a regular user to obtain unauthorized access to files and data via specifically crafted web requests.](https://agentprime.io/advisories/CVE-2021-24013.md)
  `CVE-2021-24013` · CVE record: Fortinet Fortinet FortiMail · CVSS 8.8 High · Not analysed yet · Published 12 Jul 2021
- [An improper neutralization of special elements used in an OS Command vulnerability in the administrative interface of FortiMail before 6.4.4 may allow an authenticated attacker to execute unauthorize…](https://agentprime.io/advisories/CVE-2021-24015.md)
  `CVE-2021-24015` · CVE record: Fortinet Fortinet FortiMail · CVSS 7.2 High · Not analysed yet · Published 12 Jul 2021
- [A missing release of memory after its effective lifetime vulnerability in the Webmail of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6 may allow an unauthenticated remote attacker to exhaust…](https://agentprime.io/advisories/CVE-2021-26090.md)
  `CVE-2021-26090` · CVE record: Fortinet Fortinet FortiMail · CVSS 5.3 Medium · Not analysed yet · Published 12 Jul 2021
- [Missing cryptographic steps in the Identity-Based Encryption service of FortiMail before 7.0.0 may allow an attacker who comes in possession of the encrypted master keys to compromise their confident…](https://agentprime.io/advisories/CVE-2021-26099.md)
  `CVE-2021-26099` · CVE record: Fortinet Fortinet FortiMail · CVSS 4.4 Medium · Not analysed yet · Published 12 Jul 2021
- [Multiple improper neutralization of special elements of SQL commands vulnerabilities in FortiMail before 6.4.4 may allow a non-authenticated attacker to execute unauthorized code or commands via spec…](https://agentprime.io/advisories/CVE-2021-24007.md)
  `CVE-2021-24007` · CVE record: Fortinet Fortinet FortiMail · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jul 2021
- [Multiple instances of incorrect calculation of buffer size in the Webmail and Administrative interface of FortiMail before 6.4.5 may allow an authenticated attacker with regular webmail access to tri…](https://agentprime.io/advisories/CVE-2021-22129.md)
  `CVE-2021-22129` · CVE record: Fortinet Fortinet FortiMail · CVSS 8.8 High · Not analysed yet · Published 9 Jul 2021
- [A missing cryptographic step in the Identity-Based Encryption service of FortiMail before 7.0.0 may allow an unauthenticated attacker who intercepts the encrypted messages to manipulate them in such…](https://agentprime.io/advisories/CVE-2021-26100.md)
  `CVE-2021-26100` · CVE record: Fortinet Fortinet FortiMail · CVSS 5.9 Medium · Not analysed yet · Published 9 Jul 2021
- [A missing cryptographic step in the implementation of the hash digest algorithm in FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 may allow an unauthenticated attacker to tamper with signed U…](https://agentprime.io/advisories/CVE-2021-24020.md)
  `CVE-2021-24020` · CVE record: Fortinet Fortinet FortiMail · CVSS 7.5 High · Not analysed yet · Published 9 Jul 2021
- [Fortinet FortiMail: An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7…](https://agentprime.io/advisories/CVE-2020-9294.md)
  `CVE-2020-9294` · CVE record: Fortinet FortiMail and 1 more · No CVSS score · EPSS 0.82 · Not analysed yet · Published 27 Apr 2020
- [An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to perform system backup config download they should not be authoriz…](https://agentprime.io/advisories/CVE-2019-15707.md)
  `CVE-2019-15707` · CVE record: Fortinet FortiMail · No CVSS score · Not analysed yet · Published 23 Jan 2020
- [An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to access web console they should not be authorized for.](https://agentprime.io/advisories/CVE-2019-15712.md)
  `CVE-2019-15712` · CVE record: Fortinet FortiMail · No CVSS score · Not analysed yet · Published 23 Jan 2020
- [Fortinet FortiMail: An unauthenticated XSS vulnerability with FortiMail 5.0.0 - 5.2.9 and 5.3.0…](https://agentprime.io/advisories/CVE-2017-3125.md)
  `CVE-2017-3125` · CVE record: Fortinet FortiMail · No CVSS score · Not analysed yet · Published 12 Apr 2017

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=fortinet-fortimail>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/fortinet-fortimail/>. Everything for agents: <https://agentprime.io/llms.txt>.