CVE-2021-32591

5.3 mediumEPSS 0.9%

Medium (5.3) in fortinet. EPSS 0.9% chance of exploitation in the next 30 days.

A missing cryptographic steps vulnerability in the function that encrypts users' LDAP and RADIUS credentials in FortiSandbox before 4.0.1, FortiWeb before 6.3.12, FortiADC before 6.2.1, FortiMail 7.0.1 and earlier may allow an attacker in possession of the password store to compromise the confidentiality of the encrypted secrets.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 60% of CVEs (scores of 2026-10-31)
Published: 2021-12-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

fortinet:fortiadc
fortinet:fortimail
fortinet:fortisandbox
fortinet:fortiweb

References

https://fortiguard.com/advisory/FG-IR-20-222
https://fortiguard.com/advisory/FG-IR-20-222

Check your stack JSON