Known vulnerabilities in FortiMail 7.0.1

Software: FortiMail
Version: 7.0.1
Software CPE: cpe:2.3:a:fortinet:fortinet_fortimail:*:*:*:*:*:*:*:*
Total vulnerabilities: 20
Public exploits: 4
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.3

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting FortiMail version 7.0.1 FortiMail 7.0.1 is affected by 20 vulnerabilities: 1 critical, 1 high, 9 medium, 9 low Critical High Medium Low

Vulnerabilities (20)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU123715 - Cleartext Storage of Sensitive Information
CVE-2025-55717
CWE-312 Low
No
No
7.0.9, 7.2.8, 7.4.5, 7.6.3 10.03.2026 SB2026031077
#VU118606 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVE-2025-54972
CWE-93 Low
No
No
7.6.4 18.11.2025 SB2025111875
#VU117148 - Insertion of Sensitive Information Into Sent Data
CVE-2024-47569
CWE-201 Low
No
No
7.2.7, 7.4.3 15.10.2025 SB2025101507
#VU113959 -
CVE-2024-40588
Low
No
No
7.4.4, 7.6.2 12.08.2025 SB2025081298
#VU109101 - Stack-based buffer overflow
CVE-2025-32756
CWE-121 Critical
Public exploit available
Exploited
7.0.9, 7.2.8, 7.4.5, 7.6.3 13.05.2025 SB20250513104
#VU107316 - Argument Injection or Modification
CVE-2024-56497
CWE-88 Low
No
No
6.4.8, 7.0.7, 7.2.5 09.04.2025 SB2025040982
#VU105618 - Stack-based buffer overflow
CVE-2024-46663
CWE-121 Low
No
No
7.4.4, 7.6.2 12.03.2025 SB2025031204
#VU93513 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2024-6387
CWE-362 High
Public exploit available
No
6.4.9, 7.0.8, 7.2.7, 7.4.3 01.07.2024 SB2024070144
SB2024070145
SB2024070152
and 89 more
#VU84453 - Cross-Site Request Forgery (CSRF)
CVE-2022-27488
CWE-352 Medium
No
No
6.4.7, 7.0.4 15.12.2023 SB2023121510
SB2023121511
SB2023121512
and 2 more
#VU83272 - Improper Authorization
CVE-2023-36633
CWE-285 Medium
No
No
7.0.6, 7.2.3, 7.4.0 20.11.2023 SB2023112013
#VU83269 - Improper Restriction of Excessive Authentication Attempts
CVE-2023-45582
CWE-307 Medium
No
No
6.4.9, 7.0.7, 7.2.5, 7.4.1 20.11.2023 SB2023112012
#VU81949 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-36637
CWE-79 Low
No
No
7.0.6, 7.2.3, 7.4.0 12.10.2023 SB2023101244
#VU81947 - Incorrect Authorization
CVE-2023-36556
CWE-863 Medium
No
No
6.4.8, 7.0.6, 7.2.3, 7.4.0 12.10.2023 SB2023101244
#VU68929 - Insufficient Verification of Data Authenticity
CVE-2022-26122
CWE-345 Medium
No
No
6.4.7, 7.0.3, 7.2.0 02.11.2022 SB2022110231
#VU68920 - Improper Access Control
CVE-2022-39945
CWE-284 Low
No
No
7.0.4, 7.2.1 02.11.2022 SB2022110219
#VU67038 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-26114
CWE-79 Medium
No
No
7.0.4, 7.2.0 06.09.2022 SB2022090660
#VU65981 - Use of Externally-Controlled Format String
CVE-2022-22299
CWE-134 Low
No
No
6.4.6, 7.0.3 02.08.2022 SB2022080233
SB2022080234
SB2022080235
and 1 more
#VU61391 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVE-2022-0778
CWE-835 Medium
Public exploit available
No
- 15.03.2022 SB2022031520
SB2022031522
SB2022031611
and 238 more
#VU60216 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-43062
CWE-79 Medium
Public exploit available
No
6.2.8, 6.4.6, 7.0.2 01.02.2022 SB2022020174
#VU58633 - Missing Required Cryptographic Step
CVE-2021-32591
CWE-325 Medium
No
No
- 07.12.2021 SB2021120720
SB2021120721