Email scanning continues after the final action has been taken.

DLP condition "body is empty" should be applied to the email that looks empty (with invisible characters).

SPF check fails for MS365 API mail.

DKIM checking may not work properly in some cases.

Manipulated MIME headers may bypass AV scan.

In some cases, zip files cannot be decrypted.

After upgrading from v7.0.1 to v7.0.2, DLP scan does not work properly.

Sender IP address is added to authentication reputation blocklist after delivering five to 10 email messages.

Malicious URLs in text format may bypass FortiGuard URL filter check.

DLP scan does not detect words in the headers and footers of Microsoft Word documents.

URL exemption for domain names does not work properly with "aggressive" URL checking.

Dictionary profile was triggered with no matching pattern.

DKIM check fails incorrectly.

In some cases, the content filter fails to detect HTML attachments.

DKIM check is not performed if the sender is in the safelist.

Final action of DMARC is not applied.

Quarantine report does not work for associate domains when using domain recipient policy with regular expressions.

DKIM check false positive.

Content filter with wildcard patterns cannot detect Thai language.

Successful bounce verification scan does not remove the tag.

DSNs are sent using the mail routing profile of the original email.

In some cases, email delivery may be delayed after Microsoft 365 real-time scanning.

After upgrading from v6.4 to v7.0, FortiGuard antispam service is displayed as not reachable although the service is disabled.

DANE check 2.x.x should ignore "Unable to get CRL".

The dnscached process may cache incorrect query results under heavy traffic.

Missing deployment package for VMware ESXi 7.02.

Domain disclaimers do not work properly.

IP pools in ACL rules should have higher priority over IP pools in policies.

Push update does not work properly.

System encounters reboot loop with subscription license.

Unable to configure distinguished name (DN) with more than 127 characters.

In server mode config-only HA, multiple calendar event reminders are sent to users.

When ping access is disabled on an interface, ping6 from FortiMail cannot be sent.

Subdomain-based admins with read/write access privilege are not able to view domain based settings.

In some cases, disclaimers are not added properly although the logs show otherwise.

Associated domains should use the primary domain's Bayesian database.

High CPU usage after upgrading from v6.4.5 to v6.4.6.

Fail to subscribe MS365 users due to large number of invalid users.

High memory usage caused by hasyncd.

Disclaimers are not added at the top of email messages.

If post-login banner is enabled on the admin portal, SSO login does not work.

Mail data may get corrupted when transferred to a NAS device.

Problem with system time when using GMT time zone.

Admin profile with permission to Traffic Capture cannot sniffer via CLI.

When adding a safe/block list via webmail, the entries are added successfully but the event is not logged.

No System Event logs are generated when creating/deleting a DKIM key pair.

History log search by message ID does not work.

Sender Reputation search filter does not work with relationship set to "or".

In server mode, the "Failed to open mailbox" error message may display when a webmail user tries to open a mail folder.

Unable to create safelists and blocklists.

No system event logs are generated when creating/deleting a DKIM key pair.

Webmail GUI is blocked when composing an email message and trying to edit a link.

System time section shows vertical format in Japanese GUI.

FortiMail product icon is not shown on webmail GUI in server mode.

IBE notification for new user registration and activation is in English while the language is set to German.

On the log search page, the "Load Previous Setting" button does not repopulate the Client IP field.

CWE-121: Stack-based Buffer Overflow

CWE-134: Use of Externally-Controlled Format String

CWE-329: Not Using a Random IV with CBC Mode

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-352: Cross-Site Request Forgery (CSRF)

CWE-284: Improper Access Control