LiveActive security incident?Get immediate response
CVE Record

CVE-2021-26099: Missing cryptographic steps in the Identity-Based Encryption service of FortiMail before 7.0.0 may allow an...

Missing cryptographic steps in the Identity-Based Encryption service of FortiMail before 7.0.0 may allow an attacker who comes in possession of the encrypted master keys to compromise their confidentiality by observing a few invariant properties of the ciphertext.

MediumCVSS 4.4Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

FortiMail versions before 7.0.0 have a cryptographic weakness in the Identity-Based Encryption service. If an attacker obtains encrypted master keys, they may be able to weaken confidentiality by analyzing stable ciphertext properties. This is not described as an easy remote takeover, but it matters where FortiMail protects sensitive mail encryption material.

Executive priority

Treat this as a planned security maintenance item unless FortiMail stores highly sensitive encrypted mail or key backups are broadly accessible. Prioritize upgrades for internet-facing or business-critical mail security gateways running pre-7.0.0 versions.

Technical view

The CVE describes missing cryptographic steps in FortiMail Identity-Based Encryption before 7.0.0. CVSS 3.1 is 4.4 with network attack vector, high complexity, high privileges, no user interaction, and high confidentiality impact only. The source bundle does not list CWE details, exploit code, or specific mitigation text beyond affected version boundaries.

Likely exposure

Exposure is likely limited to organizations running Fortinet FortiMail before 7.0.0, especially where the Identity-Based Encryption service is enabled or relied on for sensitive email workflows.

Exploitation context

The CVE is not listed as KEV in the provided bundle. No cited source states active exploitation. The described scenario requires the attacker to possess encrypted master keys and infer information from invariant ciphertext properties.

Researcher notes

Evidence is narrow but clear: affected product and version boundary are stated, and confidentiality impact is high under difficult prerequisites. The main research value is confirming FortiMail version, IBE usage, and whether encrypted master keys could realistically be obtained by a privileged attacker.

Mitigation direction

  • Check Fortinet advisory FG-IR-20-244 for official fixed-release guidance.
  • Upgrade FortiMail systems running versions before 7.0.0 to a non-affected release.
  • Restrict administrative and backup access to encrypted master keys.
  • Review key export, backup, and storage paths for unnecessary exposure.
  • Monitor privileged FortiMail access for unusual key-handling activity.

Validation and detection

  • Inventory all FortiMail appliances and record exact versions.
  • Flag any FortiMail deployment running a version before 7.0.0.
  • Confirm whether Identity-Based Encryption is enabled or business-critical.
  • Review who can access encrypted master keys and related backups.
  • Document remediation status against the Fortinet advisory.
Prepared
Confidence
high
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-26099 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
4.4 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
4.4CVSS 3.1MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N0.73.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

4.4Medium
CVSS 3.1 vector shape for CVE-2021-26099Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
FortinetFortinet FortiMailFortiMail before 7.0.0Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.