FortiMail vulnerabilities

38 known vulnerabilities in FortiMail from Fortinet. 38 are rated high or critical, and 2 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  FortiMail: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-126263Nov 11, 2026Fortinet

  A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.4, FortiMail 7.4.0 through 7.4.6 may allow an authenticated attacker to execute unauthor

• 7.2 High severity

  FortiMail: Improper Neutralization of Argument Delimiters in a Command

  CVE-2026-126169Nov 11, 2026Fortinet

  A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated re

• 7.2 High severity

  FortiMail: Improper Neutralization of Argument Delimiters in a Command

  CVE-2026-126168Nov 11, 2026Fortinet

  A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated re

• 7.2 High severity

  FortiMail: Improper Neutralization of Special Elements used in a Command

  CVE-2026-126167Nov 11, 2026FortinetEPSS 1.51%

  A improper neutralization of special elements used in a command ('command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated r

• 7.2 High severity

  FortiMail: Improper Neutralization of Argument Delimiters in a Command

  CVE-2026-126166Nov 11, 2026Fortinet

  A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated re

• 7.5 High severity

  FortiMail: Memory Allocation with Excessive Size Value

  CVE-2026-126165Nov 11, 2026Fortinet

  A memory allocation with excessive size value vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow a remote unauthenticated attacker to cause a denial of ser

• 9.4 Critical severity

  FortiMail: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-126164Nov 11, 2026Fortinet

  A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticate

• 8.1 High severity

  FortiMail: Use of Externally-Controlled Format String

  CVE-2026-126163Nov 11, 2026Fortinet

  A use of externally-controlled format string vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1 may allow a remote unauthenticated attacker to execute unauthorized code or commands via a specially crafted SMTP command.

• 8.7 High severity

  FortiMail: XML Injection

  CVE-2026-126162Nov 11, 2026Fortinet

  A xml injection (aka blind xpath injection) vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6 may allow a remote unauthenticated attacker to execute unauthorized code or commands via a specially crafted request.

• 7.5 High severity

  FortiMail: Uncontrolled Resource Consumption

  CVE-2026-126161Nov 11, 2026Fortinet

  A uncontrolled resource consumption vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.6 may allow a remote unauthenticated attacker to cause a denial of service via repeated unauthenticated POST

• 8.2 High severity

  FortiMail: Improper Authentication

  CVE-2026-126160Nov 11, 2026Fortinet

  A improper authentication vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to escalate privileges and release or delete quara

• 7.5 High severity

  FortiMail: Authorization Bypass Through User-Controlled Key

  CVE-2026-126159Nov 11, 2026Fortinet

  A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to release or delete quar

• 7.2 High severity

  FortiMail: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-126158Nov 11, 2026FortinetEPSS 1.07%

  A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1 may allow an authenticated administrator to execute unauthorized code or commands as root via specially crafted

• 9.1 Critical severity

  FortiMail: Improper Authentication

  CVE-2026-126157Nov 11, 2026Fortinet

  A improper authentication vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to gain access to other users' secure email accoun

• 9.1 Critical severity

  FortiMail: Authorization Bypass Through User-Controlled Key

  CVE-2026-126156Nov 11, 2026Fortinet

  A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to take over an ar

• 9.1 Critical severity

  FortiMail: Incorrect Authorization

  CVE-2026-126155Nov 11, 2026Fortinet

  A incorrect authorization vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to obtain an authenticated IBE webmail sess

• 7.5 High severity

  FortiMail: Out-of-bounds Write

  CVE-2026-126154Nov 11, 2026Fortinet

  A out-of-bounds write vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow a remote unauthenticated attacker to cause a denial of service via a specially cra

• 7.5 High severity

  FortiMail: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-126153Nov 11, 2026Fortinet

  A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated atta

• 7.6 High severity

  FortiMail: Authorization Bypass Through User-Controlled Key

  CVE-2026-126152Nov 11, 2026Fortinet

  A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker to delete arbitrary

• 7.5 High severity

  FortiMail: Incorrect Implementation of Authentication Algorithm

  CVE-2026-126151Nov 11, 2026Fortinet

  A incorrect implementation of authentication algorithm vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to gain elevat

• 9.1 Critical severity

  FortiMail: Weak Password Recovery Mechanism for Forgotten Password

  CVE-2026-126150Nov 11, 2026Fortinet

  A weak password recovery mechanism for forgotten password vulnerability in Fortinet FortiMail 8.0.0, FortiMail 7.6.0 through 7.6.5, FortiMail 7.4.0 through 7.4.7, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to reset the password of an a

• 7.5 High severity

  FortiMail: Integer Overflow or Wraparound

  CVE-2026-126149Nov 11, 2026Fortinet

  A integer overflow or wraparound vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow a remote unauthenticated attacker to crash the daemon.

• 9.8 Critical severity

  FortiMail: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-126148Nov 11, 2026FortinetEPSS 2.44%

  A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6 may allow an unauthenticated attacker to execute unauthorized code or commands v

• 9.8 Critical severity

  FortiMail: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-126147Nov 11, 2026Fortinet

  A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated atta

• 7.2 High severity

  FortiMail: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-126146Nov 11, 2026Fortinet

  A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.4, FortiMail 7.4.0 through 7.4.6, FortiMail 7.2.0 through 7.2.9, FortiRecorder 7.6

• 7.2 High severity

  FortiMail: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-126145Nov 11, 2026Fortinet

  A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenti

• 8.8 High severity

  FortiMail: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-126144Nov 11, 2026FortinetEPSS 1.06%

  A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.4, FortiMail 7.4.0 through 7.4.6, FortiMail 7.2 all versions, FortiRecorder 7.6.0

• 8.8 High severity

  FortiMail: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2025-57739Oct 13, 2026Fortinet

  An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 through 7.4.5, FortiMail 7.2.0 through 7.2.8 allows an authenticated attacke

• 9.8 Critical severity

  Fortinet FortiMail Path Traversal Exploited

  CVE-2026-104286Oct 1, 2026FortinetEPSS 4.57%

  An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9, FortiMail 7.0 all versions m

• 7.2 High severity

  FortiMail: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2025-53681May 12, 2026Fortinet

  An improper neutralization of special elements used in an SQL Command ("SQL Injection&") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 through 7.4.5, FortiMail 7.2.0 through 7.2.8 allows an authenticated privil

• 9.8 Critical severity

  Fortinet Multiple Products Stack-Based Buffer Overflow Exploited

  CVE-2025-32756May 13, 2025FortinetEPSS 30.9%

  A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions, FortiCamera 1.1 all versions, FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0 through 7.4.4, FortiMail 7.2.0 through 7

• 8.8 High severity

  FortiNDR: Buffer Copy without Checking Size of Input

  CVE-2023-33302Mar 31, 2025Fortinet

  A buffer copy without checking size of input ('classic buffer overflow') in Fortinet FortiMail webmail and administrative interface version 6.4.0 through 6.4.4 and before 6.2.6 and FortiNDR administrative interface version 7.2.0 and before 7.1.0 allows an auth

• 9.8 Critical severity

  FortiMail: Improper Access Control

  CVE-2023-47539Mar 18, 2025FortinetEPSS 1.06%

  An improper access control vulnerability in FortiMail version 7.4.0 configured with RADIUS authentication and remote_wildcard enabled may allow a remote unauthenticated attacker to bypass admin login via a crafted HTTP request.

• 8.8 High severity

  FortiVoice: Cross-Site Request Forgery

  CVE-2022-27488Dec 13, 2023Fortinet

  A cross-site request forgery (CSRF) in Fortinet FortiVoiceEnterprise version 6.4.x, 6.0.x, FortiSwitch version 7.0.0 through 7.0.4, 6.4.0 through 6.4.10, 6.2.0 through 6.2.7, 6.0.x, FortiMail version 7.0.0 through 7.0.3, 6.4.0 through 6.4.6, 6.2.x, 6.0.x Forti

• 7.3 High severity

  FortiMail: Improper Restriction of Excessive Authentication Attempts

  CVE-2023-45582Nov 14, 2023Fortinet

  An improper restriction of excessive authentication attempts vulnerability [CWE-307] in FortiMail webmail version 7.2.0 through 7.2.4, 7.0.0 through 7.0.6 and before 6.4.8 may allow an unauthenticated attacker to perform a brute force attack on the affected en

• 8.8 High severity

  FortiMail: Incorrect Authorization

  CVE-2023-36556Oct 10, 2023FortinetEPSS 1.09%

  An incorrect authorization vulnerability [CWE-863] in FortiMail webmail version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.5 and below 6.4.7 allows an authenticated attacker to login on other users accounts from the same web domain via crafted HTTP or HTTP

• 8.6 High severity

  Fortinet AV Engine, FortiMail, FortiOS…: Insufficient Verification of Data Authenticity

  CVE-2022-26122Nov 2, 2022Fortinet

  An insufficient verification of data authenticity vulnerability [CWE-345] in FortiClient, FortiMail and FortiOS AV engines version 6.2.168 and below and version 6.4.274 and below may allow an attacker to bypass the AV engine via manipulating MIME attachment wi

• 7.8 High severity

  Fortinet FortiADC, FortiProxy, FortiMail…: Use of Externally-Controlled Format String

  CVE-2022-22299Aug 5, 2022Fortinet

  A format string vulnerability [CWE-134] in the command line interpreter of FortiADC version 6.0.0 through 6.0.4, FortiADC version 6.1.0 through 6.1.5, FortiADC version 6.2.0 through 6.2.1, FortiProxy version 1.0.0 through 1.0.7, FortiProxy version 1.1.0 throug