CVE-2021-26090

MEDIUM

FortiMail 6.2.0-6.2.6 and 6.4.0-6.4.4 - Unauthenticated Memory Exhaustion via Webmail Login Requests

Title source: llm

Description

A missing release of memory after its effective lifetime vulnerability in the Webmail of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6 may allow an unauthenticated remote attacker to exhaust available memory via specifically crafted login requests.

References (1)

Core 1

Core References

Vendor Advisory x_refsource_confirm

https://fortiguard.com/advisory/FG-IR-21-042

Scores

CVSS v3 5.3

EPSS 0.0042

EPSS Percentile 62.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-401

Status published

Products (1)

fortinet/fortimail 6.2.0 - 6.2.6

Published Jul 12, 2021

Tracked Since Feb 18, 2026