CVE-2021-24007: Fortinet FortiMail

Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days.

Multiple improper neutralization of special elements of SQL commands vulnerabilities in FortiMail before 6.4.4 may allow a non-authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

Affected products

• Fortinet FortiMail: up to and including 5.4.12; from 5.6.1, before 6.0.11 (fixed in 6.0.11); from 6.2.0, before 6.2.7 (fixed in 6.2.7); from 6.4.0, before 6.4.4 (fixed in 6.4.4)

Published 2021-07-09. Last modified 2026-06-17.