Administrative authentication bypass Fortinet PSIRT Advisories Fortinet PSIRT Contact: Website: https://fortiguard.fortinet.com/faq/psirt-contact FG-IR-21-028 Final 1 1 2022-03-01T00:00:00 Current version 2022-03-01T00:00:00 2022-03-01T00:00:00 An improper authentication vulnerability [CWE-287] in FortiMail may allow a remote attacker to efficiently guess one administrative account's authentication token by means of the observation of certain system's properties. None Improper access control FortiMail version 7.0.0 and below.FortiMail version 6.4.5 and below.FortiMail version 6.2.7 and below.FortiMail version 6.0.11 and below.FortiMail version 5.4.12 and below. Upgrade to FortiMail version 7.0.1.Upgrade to FortiMail version 6.4.6.Upgrade to FortiMail version 6.2.8.Upgrade to FortiMail version 6.0.12. Discovered and reported by Giuseppe Cocomazzi of Fortinet Product Security team. CVE-2021-36166 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C https://fortiguard.fortinet.com/psirt/FG-IR-21-028 Administrative authentication bypass Reference>