CVE-2021-26095high

CVE-2021-26095: high-severity vulnerability in Fortinet FortiMail

Published · Updated

Follow this CVE+ Monitor FortiMail

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.7%
The combination of various cryptographic issues in the session management of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6, including the encryption construction of the session cookie, may allow a remote attacker already in possession of a cookie to possibly reveal and alter or forge its content, thereby escalating privileges.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Fortinet · Fortinet FortiMail
Related CVEs — Fortinet FortiMail

In the same product, most dangerous first.

CVE-2021-43062MEDIUMCVE-2021-43062EPSS 12.9%CVE-2021-36166CRITICALCVE-2021-36166EPSS 1.5%CVE-2021-24007CRITICALCVE-2021-24007EPSS 1.4%CVE-2021-26090MEDIUMCVE-2021-26090EPSS 1.3%CVE-2021-24015HIGHCVE-2021-24015EPSS 1.2%CVE-2021-24013HIGHCVE-2021-24013EPSS 1.1%