{"id":"CVE-2021-26091","state":"PUBLISHED","title":"A use of a cryptographically weak pseudo-random number generator vulnerability in the authenticator of the Identity Based Encryption service of FortiMail 6.4.0 through 6.4.4, and 6","description":"A use of a cryptographically weak pseudo-random number generator vulnerability in the authenticator of the Identity Based Encryption service of FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 may allow an unauthenticated attacker to infer parts of users authentication tokens and reset their credentials.","publishedAt":"2025-03-24T15:37:58.370Z","updatedAt":"2025-03-31T18:11:58.179Z","severity":{"score":6.9,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:U/RC:C","source":"fortinet"},"assigner":"fortinet","products":["Fortinet FortiMail"],"affected":[{"vendor":"Fortinet","product":"FortiMail","defaultStatus":"unaffected","versions":[{"version":"6.4.0","status":"affected","lessThanOrEqual":"6.4.4","versionType":"semver"},{"version":"6.2.0","status":"affected","lessThanOrEqual":"6.2.9","versionType":"semver"},{"version":"6.2.0","status":"affected","lessThan":"6.2.*","versionType":"semver"}],"cpes":["cpe:2.3:a:fortinet:fortimail:6.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:6.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:6.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:6.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:6.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:6.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:6.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:6.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:6.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:6.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:6.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:6.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:6.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:6.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:6.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:6.2.*:*:*:*:*:*:*:*"]}],"references":["https://fortiguard.com/advisory/FG-IR-21-031"],"weaknesses":["CWE-338"],"ingestedAt":"2026-10-29T19:48:13.210Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/26xxx/CVE-2021-26091.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2021-26091","state":"PUBLISHED","datePublished":"2025-03-24T15:37:58.370Z","dateUpdated":"2025-03-31T18:11:58.179Z","assignerShortName":"fortinet","assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateReserved":"2021-01-25T14:47:15.092Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A use of a cryptographically weak pseudo-random number generator vulnerability in the authenticator of the Identity Based Encryption service of FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 may allow an unauthenticated attacker to infer parts of users authentication tokens and reset their credentials."}],"affected":[{"vendor":"Fortinet","product":"FortiMail","defaultStatus":"unaffected","versions":[{"version":"6.4.0","status":"affected","lessThanOrEqual":"6.4.4","versionType":"semver"},{"version":"6.2.0","status":"affected","lessThanOrEqual":"6.2.9","versionType":"semver"},{"version":"6.2.0","status":"affected","lessThan":"6.2.*","versionType":"semver"}],"cpes":["cpe:2.3:a:fortinet:fortimail:6.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:6.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:6.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:6.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:6.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:6.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:6.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:6.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:6.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:6.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:6.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:6.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:6.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:6.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:6.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:6.2.*:*:*:*:*:*:*:*"]}],"references":[{"url":"https://fortiguard.com/advisory/FG-IR-21-031","name":"https://fortiguard.com/advisory/FG-IR-21-031"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:U/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-338","lang":"en","description":"Improper Access Control","type":"CWE"}]}],"providerMetadata":{"shortName":"fortinet","orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateUpdated":"2025-03-24T15:37:58.370Z"},"solutions":[{"lang":"en","value":"Please upgrade to FortiMail version 7.0.0 or above\nPlease upgrade to FortiMail version 6.4.5 or above"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-03-31T18:11:46.513539Z","id":"CVE-2021-26091","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-03-31T18:11:58.179Z"}}]}}}