CVE-2023-45582: Fortinet FortiMail

High severity, CVSS 7.3. EPSS: 0.5% chance of exploitation in the next 30 days.

An improper restriction of excessive authentication attempts vulnerability [CWE-307] in FortiMail webmail version 7.2.0 through 7.2.4, 7.0.0 through 7.0.6 and before 6.4.8 may allow an unauthenticated attacker to  perform a brute force attack on the affected endpoints via repeated login attempts.

Affected products

• Fortinet FortiMail: from 6.2.0, up to and including 6.2.9; from 6.4.0, up to and including 6.4.8; from 7.0.0, up to and including 7.0.6; from 7.2.0, up to and including 7.2.4; version 7.4.0 only

Published 2023-11-14. Last modified 2026-06-17.