CVE-2020-9294

CVE-2020-9294: vulnerability in Fortinet FortiMail

Published · Updated

Follow this CVE+ Monitor FortiMail+ Monitor FortiVoiceEnterprise

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

40Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 82%
An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 and earlier and FortiVoiceEntreprise 6.0.0 and 6.0.1 may allow a remote unauthenticated attacker to access the system as a legitimate user by requesting a password change via the user interface.
Affected products
Fortinet · FortiMailFortinet · FortiVoiceEnterprise
Related CVEs — Fortinet FortiMail

In the same product, most dangerous first.

CVE-2025-32756CRITICALCVE-2025-32756EPSS 30.9%KEVCVE-2026-104286CRITICALCVE-2026-104286EPSS 4.6%KEVCVE-2022-29056LOWCVE-2022-29056EPSS 1.8%CVE-2017-3125—CVE-2017-3125EPSS 1.1%CVE-2023-36556HIGHCVE-2023-36556EPSS 1.1%CVE-2023-47539CRITICALCVE-2023-47539EPSS 1.1%