CVE-2021-26095

low-risk
Published 2021-07-20

The combination of various cryptographic issues in the session management of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6, including the encryption construction of the session cookie, may allow a remote attacker already in possession of a cookie to possibly reveal and alter or forge its content, thereby escalating privileges.

Do I need to act?

-
0.31% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / HIGH complexity

Affected Products (1)

Affected Vendors

Fortinet

References (2)

Vendor Advisory https://fortiguard.com/advisory/FG-IR-21-019
Vendor Advisory https://fortiguard.com/advisory/FG-IR-21-019
28
/ 100
low-risk
Severity 22/34 · High
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal