FortiMail

Affected and fixed version statements observed in the public BlackTree CVE catalogue. These statements describe vulnerability scope, not publisher support entitlement.

Lifecycle evidence status

This CVE identity is linked to the Lifecycle record Fortinet FortiMail. Use that record for publisher support phases and retirement dates.

A missing support date does not mean the product is supported. CVE publication dates and affected-version ranges must not be interpreted as EOL dates.

CVE-observed version history

CVE	Published	Affected versions	Fixed version information	Publisher evidence
CVE-2026-104286	1 Oct 2026	FortiMail: 8.0.0, 7.6.0 ≤ 7.6.5, 7.4.0 ≤ 7.4.6, 7.2.0 ≤ 7.2.9, 7.0.0 ≤ 7.0.9	Upgrade to upcoming FortiMail version 8.0.1 or above; Upgrade to upcoming FortiMail version 7.6.6 or above; Upgrade to upcoming FortiMail version 7.4.8 or above; Upgrade to upcoming FortiMail version 7.2.10 or above; Upgrade to FortiRecorder version 7.6.1 or above; Upgrade to FortiRecorder version 7.2.12 or above; Upgrade to upcoming FortiRecorder version 7.0.7 or above; Fortinet remediated this issue in FortiMail Cloud version 25.1 (not released) and hence customers do not need to perform any action.	Update reference ↗
CVE-2025-53681	12 May 2026	FortiMail: 7.6.0 ≤ 7.6.3, 7.4.0 ≤ 7.4.5, 7.2.0 ≤ 7.2.8	Upgrade to FortiMail version 7.6.4 or above; Upgrade to FortiMail version 7.4.6 or above; Upgrade to FortiMail version 7.2.9 or above; Fortinet remediated this issue in FortiMail Cloud version 25.2 and hence customers do not need to perform any action.	Update reference ↗
CVE-2025-54972	18 Nov 2025	7.6.0 ≤ 7.6.3; 7.4.0 ≤ 7.4.5; 7.2.0 ≤ 7.2.9; 7.0.0 ≤ 7.0.9	No fixed version is explicitly recorded in the structured CVE data.	Use CVE record
CVE-2021-26091	24 Mar 2025	6.4.0 ≤ 6.4.4; 6.2.0 ≤ 6.2.9; 6.2.0 < 6.2.*	No fixed version is explicitly recorded in the structured CVE data.	Use CVE record
CVE-2023-47539	18 Mar 2025	7.4.0	No fixed version is explicitly recorded in the structured CVE data.	Use CVE record
CVE-2024-46663	11 Mar 2025	7.6.0 ≤ 7.6.1; 7.4.0 ≤ 7.4.3; 7.2.0 ≤ 7.2.7; 7.0.0 ≤ 7.0.8; 6.4.0 ≤ 6.4.8	No fixed version is explicitly recorded in the structured CVE data.	Use CVE record
CVE-2024-56497	14 Jan 2025	7.2.0 ≤ 7.2.4; 7.0.0 ≤ 7.0.6; 6.4.0 ≤ 6.4.7; 7.0.0; 6.4.0 ≤ 6.4.4	No fixed version is explicitly recorded in the structured CVE data.	Use CVE record
CVE-2023-36633	14 Nov 2023	7.2.0 ≤ 7.2.2; 7.0.0 ≤ 7.0.5; 6.4.0 ≤ 6.4.8; 6.2.0 ≤ 6.2.9; 6.0.0 ≤ 6.0.12	No fixed version is explicitly recorded in the structured CVE data.	Use CVE record
CVE-2023-45582	14 Nov 2023	7.4.0; 7.2.0 ≤ 7.2.4; 7.0.0 ≤ 7.0.6; 6.4.0 ≤ 6.4.8; 6.2.0 ≤ 6.2.9	No fixed version is explicitly recorded in the structured CVE data.	Use CVE record
CVE-2023-36637	10 Oct 2023	7.2.0 ≤ 7.2.2; 7.0.1 ≤ 7.0.5	No fixed version is explicitly recorded in the structured CVE data.	Use CVE record
CVE-2023-36556	10 Oct 2023	7.2.0 ≤ 7.2.2; 7.0.0 ≤ 7.0.5; 6.4.0 ≤ 6.4.7; 6.2.0 ≤ 6.2.9; 6.0.0 ≤ 6.0.12	No fixed version is explicitly recorded in the structured CVE data.	Use CVE record
CVE-2022-29056	9 Mar 2023	6.4.0; 6.2.1 ≤ 6.2.4; 6.0.0 ≤ 6.0.9; 5.4.0 ≤ 5.4.12	No fixed version is explicitly recorded in the structured CVE data.	Use CVE record
CVE-2020-9294	27 Apr 2020	5.4.10; 6.0.7; 6.2.2 and earlier; 6.0.0; 6.0.1	No fixed version is explicitly recorded in the structured CVE data.	Use CVE record
CVE-2017-3125	12 Apr 2017	5.0.0 -> 5.2.9, 5.3.0 -> 5.3.8	No fixed version is explicitly recorded in the structured CVE data.	Use CVE record

How this record is maintained

The CVE inventory is reconciled automatically from cve.blacktree.nl. Exact identity matches link to existing Lifecycle product or package histories. Unmatched products stay in a prioritised publisher-source research queue, and Lifecycle marks the date gap instead of inferring a support boundary from vulnerability data.