Loading vulnerability…
CRLF Header Injection in Fortinet FortiMail User GUI
CVE-2025-54972 is an improper neutralization of CRLF sequences vulnerability in the FortiMail user GUI. Affected versions are FortiMail 7.6.0 through 7.6.3, 7.4.0 through 7.4.5, all 7.2 versions, and all 7.0 versions. The flaw allows response header injection when a user is convinced to click a specifically crafted link, indicating that attacker-controlled input is incorporated into an HTTP response without properly neutralizing carriage return and line feed characters. This can enable an attacker to inject arbitrary headers into the server response delivered to the victim user.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an attacker to manipulate the HTTP response seen by a victim by injecting attacker-controlled headers. Depending on browser behavior and application context, this can be used to alter response handling, influence redirects, set or overwrite headers, and potentially facilitate follow-on attacks such as cache poisoning, session manipulation, or other web-layer abuses. The provided content does not establish direct code execution or privilege escalation from this flaw alone.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure of the FortiMail user GUI to untrusted users and external networks where feasible, place administrative or user-facing interfaces behind access controls, and monitor for suspicious crafted-link delivery attempts. User awareness measures can reduce the likelihood of successful exploitation because the issue requires a victim to click a specially crafted link. Web application filtering or reverse proxy controls that normalize or reject malicious CRLF sequences in request parameters may also reduce risk, though vendor patching is the primary mitigation.
Patch, then assume compromise.
Upgrade FortiMail to a fixed release provided by Fortinet. The vulnerable versions identified are 7.6.0 through 7.6.3, 7.4.0 through 7.4.5, all 7.2 versions, and all 7.0 versions; organizations should move to the vendor-patched version in the relevant supported branch or later. Standard remediation should include validating that all internet-exposed FortiMail user GUI instances are updated and reviewing vendor advisories for exact fixed builds.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.