CVE-2021-26095: fortinet fortimail
Vulnerability summary
CVE-2021-26095 is a high (CVSS 8.8) vulnerability in fortinet fortimail. EPSS estimates a 0.69% chance of exploitation in the next 30 days, higher than 51.9% of scored vulnerabilities.
Timeline
- 20-07-2021PublishedVulnerability first disclosed.
- 25-10-2024Last modifiedVulnerability information updated.
Description
The combination of various cryptographic issues in the session management of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6, including the encryption construction of the session cookie, may allow a remote attacker already in possession of a cookie to possibly reveal and alter or forge its content, thereby escalating privileges.
CVSS metrics
3 scores · 2 sources · 2 versions- CVE.orgCNA7.5HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
0.69%
Chance of exploitation in the next 30 days
Percentile
52%
Versus all other CVEs
30-day change
0.00 pp
From 0.69% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Fortinet2 products
- fortimail≥ 6.2.0, ≤ 6.2.6 | ≥ 6.4.0, < 6.4.5
- fortinet fortimailFortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6
1 vendor · 2 products