Known vulnerabilities in FortiMail

Software: FortiMail
Software CPE: cpe:2.3:a:fortinet:fortinet_fortimail:*:*:*:*:*:*:*:*
Total vulnerabilities: 40
Public exploits: 6
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting FortiMail FortiMail is affected by 40 known vulnerabilities: 1 critical, 8 high, 16 medium, 15 low Critical High Medium Low

Vulnerabilities (40)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU131200 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-53681
CWE-89 Low
No
No
7.2.9, 7.4.6, 7.6.4 12.05.2026 SB2026051295
#VU123715 - Cleartext Storage of Sensitive Information
CVE-2025-55717
CWE-312 Low
No
No
7.0.9, 7.2.8, 7.4.5, 7.6.3 10.03.2026 SB2026031077
#VU118606 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVE-2025-54972
CWE-93 Low
No
No
7.6.4 18.11.2025 SB2025111875
#VU117148 - Insertion of Sensitive Information Into Sent Data
CVE-2024-47569
CWE-201 Low
No
No
7.2.7, 7.4.3 15.10.2025 SB2025101507
#VU113959 -
CVE-2024-40588
Low
No
No
7.4.4, 7.6.2 12.08.2025 SB2025081298
#VU109101 - Stack-based buffer overflow
CVE-2025-32756
CWE-121 Critical
Available
Exploited
7.0.9, 7.2.8, 7.4.5, 7.6.3 13.05.2025 SB20250513104
#VU107316 - Argument Injection or Modification
CVE-2024-56497
CWE-88 Low
No
No
6.4.8, 7.0.7, 7.2.5 09.04.2025 SB2025040982
#VU105618 - Stack-based buffer overflow
CVE-2024-46663
CWE-121 Low
No
No
7.4.4, 7.6.2 12.03.2025 SB2025031204
#VU93513 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2024-6387
CWE-362 High
Available
No
6.4.9, 7.0.8, 7.2.7, 7.4.3 01.07.2024 SB2024070144
SB2024070145
SB2024070152
and 89 more
#VU84453 - Cross-Site Request Forgery (CSRF)
CVE-2022-27488
CWE-352 Medium
No
No
6.4.7, 7.0.4 15.12.2023 SB2023121510
SB2023121511
SB2023121512
and 2 more
#VU84450 - Improper Authentication
CVE-2023-47539
CWE-287 High
No
No
7.4.1 15.12.2023 SB2023121509
#VU83272 - Improper Authorization
CVE-2023-36633
CWE-285 Medium
No
No
7.0.6, 7.2.3, 7.4.0 20.11.2023 SB2023112013
#VU83269 - Improper Restriction of Excessive Authentication Attempts
CVE-2023-45582
CWE-307 Medium
No
No
6.4.9, 7.0.7, 7.2.5, 7.4.1 20.11.2023 SB2023112012
#VU81949 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-36637
CWE-79 Low
No
No
7.0.6, 7.2.3, 7.4.0 12.10.2023 SB2023101244
#VU81947 - Incorrect Authorization
CVE-2023-36556
CWE-863 Medium
No
No
6.4.8, 7.0.6, 7.2.3, 7.4.0 12.10.2023 SB2023101244
#VU74994 - Improper Restriction of Excessive Authentication Attempts
CVE-2022-29056
CWE-307 Low
No
No
6.0.10, 6.2.5, 6.4.1 12.04.2023 SB2023041203
#VU68929 - Insufficient Verification of Data Authenticity
CVE-2022-26122
CWE-345 Medium
No
No
6.4.7, 7.0.3, 7.2.0 02.11.2022 SB2022110231
#VU68920 - Improper Access Control
CVE-2022-39945
CWE-284 Low
No
No
7.0.4, 7.2.1 02.11.2022 SB2022110219
#VU67038 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-26114
CWE-79 Medium
No
No
7.0.4, 7.2.0 06.09.2022 SB2022090660
#VU65981 - Use of Externally-Controlled Format String
CVE-2022-22299
CWE-134 Low
No
No
6.4.6, 7.0.3 02.08.2022 SB2022080233
SB2022080234
SB2022080235
and 1 more


Showing elements 1 - 20 out of 40