CVE-2021-32586: Fortinet FortiMail

Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days.

An improper input validation vulnerability in the web server CGI facilities of FortiMail before 7.0.1 may allow an unauthenticated attacker to alter the environment of the underlying script interpreter via specifically crafted HTTP requests.

Affected products

• Fortinet FortiMail: up to and including 5.4.12; from 6.0.0, before 6.0.12 (fixed in 6.0.12); from 6.2.0, before 6.2.8 (fixed in 6.2.8); from 6.4.0, before 6.4.6 (fixed in 6.4.6); version 7.0.0 only

Published 2022-03-01. Last modified 2026-06-17.