FortiMail vulnerabilities and CVEs
Known vulnerabilities affecting FortiMail, with exploit availability attached to each one, so you can tell a flaw someone has written code for from one nobody has.
28 vulnerabilities tracked. 1 confirmed exploited in the wild. 1 with public exploit code.
- — Fortinet FortiMail Path Traversal Vulnerability
- 9.8 A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1,…
- 9.8 A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0…
- 9.4 A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiMail 8.0.0 through…
- 9.4 A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiMail 8.0.0 through…
- 9.1 A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6,…
- 9.1 A incorrect authorization vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through…
- 9.1 A improper authentication vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through…
- 9.1 A weak password recovery mechanism for forgotten password vulnerability in Fortinet FortiMail 8.0.0, FortiMail 7.6.0 through 7.6.5,…
- 8.8 A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0…
- 8.7 A xml injection (aka blind xpath injection) vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6 may…
- 8.2 A improper authentication vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through…
- 8.1 A use of externally-controlled format string vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1 may allow a remote unauthenticated…
- 7.6 A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6,…
- 7.5 A memory allocation with excessive size value vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6,…
- 7.5 A uncontrolled resource consumption vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0…
- 7.5 A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6,…
- 7.5 A incorrect implementation of authentication algorithm vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through…
- 7.5 A out-of-bounds write vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through…
- 7.5 A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1,…
- 7.5 A integer overflow or wraparound vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0…
- 7.2 A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiMail 8.0.0 through…
- 7.2 A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiMail 8.0.0 through…
- 7.2 A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiMail 8.0.0 through…
- 7.2 A improper neutralization of special elements used in a command ('command injection') vulnerability in Fortinet FortiMail 8.0.0 through…
- 7.2 A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0…
- 7.2 A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0…
- 7.2 A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0…
What this covers
This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that FortiMail is free of vulnerabilities.
Query this from an agent over MCP · Check a lockfile by version
Other products tracked here
Windows Server 2025 Windows Server 2025 (Server Core installation) Linux Windows 11 version 26H1 Windows 11 Version 24H2 Windows 11 Version 25H2 Windows Server 2022 Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 21H2 Windows 10 Version 22H2 Windows 10 Version 1809 Windows 11 Version 23H2 Windows Server 2016 Windows Server 2016 (Server Core installation) Windows 10 Version 1607 Windows 11 Version 26H2 Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Windows Server 2012 R2 Windows Server 2012 R2 (Server Core installation) Windows Server 2012 Windows Server 2012 (Server Core installation) Red Hat Enterprise Linux 10