For the system quarantine, alphabetical sort ordering for the Ukrainian alphabet was not correct for some characters.

With FortiSandbox, high CPU usage and delayed mail could occur with heuristic and QR code scans.

When upgrading the FortiGuard Antivirus database, smtpd may terminate.

A DMARC report is not generated when the domain name for the RUA mailto does not match the sender domain.

In some cases, if the DMARC alignment check fails, then the DMARC check still will not fail.

With FortiSandbox, phishing URLs with specific character combinations are not caught.

In Gmail, quarantine reports could not use the webmail method to release or delete email.

Some URLs in an email may not be submitted to FortiSandbox.

High CPU usage by mailfilterd could occur with some PDF attachments.

Some attachment file names cause email with an empty recipient that cannot be released from the system quarantine.

In DLP rules, a regular expression match all condition does not function correctly if both Body is empty and Subject is empty.

For dictionary scans with regular expressions, valid patterns sometimes did not match UTF-8 encoded subject lines.

When creating a scheduled scan in the Microsoft 365 API view, the advanced condition is ignored.

When a ZIP file is password-encrypted but the content profile does not have the password, sometimes FortiMail does not quarantine the file as expected, but instead submits it to FortiSandbox. This causes an error log on FortiSandbox: WARNING: Wrong password for file submission

In some cases, the URL for IBE password reset or reactivation incorrectly gives an HTTP 403 Forbidden permissions error.

Outgoing mail queues sometimes may grow and become slow to deliver, clear, or display on the GUI.

For FortiGate Security Fabric communications, FortiMail broadcasts destination port number 8014 to the wrong IP address.

Some SSH key exchange algorithms should be removed when strong cryptography is enabled.

In active-active mode with HA, SNMP OIDs fmlHAEffectiveMode and fmlHAMode show the wrong roles.

In alert email, a recipient with an internal domain could not be added due to strict domain checking.

When a user with the same name exists in an LDAP directory, a new user could not be created locally.

Quarantine reports may be garbled when special characters are used in the email subject and remove-active-content is enabled.

Scheduled reports are delivered later than expected.

Log message Timed out checking block safe lists is misleading.

In some cases, HTML email is not displayed properly.