CVE-2021-26091

7.5 highEPSS 0.3%

High (7.5) in fortinet fortimail. EPSS 0.3% chance of exploitation in the next 30 days.

A use of a cryptographically weak pseudo-random number generator vulnerability in the authenticator of the Identity Based Encryption service of FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 may allow an unauthenticated attacker to infer parts of users authentication tokens and reset their credentials.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 23% of CVEs (scores of 2026-10-31)
CWE: CWE-338
Published: 2025-03-24
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

fortinet:fortimail

References

https://fortiguard.com/advisory/FG-IR-21-031

Check your stack JSON