fortimail

Live3

1. live9.8
   FortiMail FortiMail path traversal enables unauthorized code execution

   Patch now · Disclosed · since 10 Nov 2026

   An improper limitation of a pathname (CWE‑22) in FortiMail allows an unauthenticated attacker to traverse directories and execute unauthorized code via crafted requests. The issue is rated CVSS v3 9.8, marking it as a critical vulnerability.
2. live9.8
   FortiMail FortiMail command injection allows unauthenticated code execution

   Patch now · Disclosed · since 10 Nov 2026

   An improper neutralization of special elements in a command (CWE‑77) in FortiMail permits an unauthenticated attacker to execute unauthorized code via crafted HA join‑request packets. The vulnerability carries a CVSS v3 score of 9.8, indicating a critical risk.
3. live9.1
   FortiMail Fortinet FortiMail Incorrect Authorization Vulnerability

   Patch now · Disclosed · since 10 Nov 2026

   An incorrect authorization flaw in FortiMail allows unauthenticated remote attackers to hijack IBE webmail sessions and access encrypted emails. Fortinet disclosed the vulnerability with a CVSS score of 9.1.

   Do:Check Fortinet advisory for patch availability and apply updates.

Earlier0

Nothing closed yet.