[ Vendor · 44 CVEs ]
Fortinet
CVEs affecting Fortinet published in the last 30 days, plus any Fortinet CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-23705 | 13 Oct 2026 | CVSS 7.2 | Fortinet FortiAnalyzerAn Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet… | Fix |
| CVE-2026-23706 | 13 Oct 2026 | CVSS 6.5 | Fortinet FortiAnalyzer CloudAn Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet… | Fix |
| CVE-2026-23707 | 13 Oct 2026 | CVSS 7.2 | Fortinet FortiManager CloudAn Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet… | Fix |
| CVE-2026-106176 | 13 Oct 2026 | CVSS 3.8 | Fortinet FortiSIEMA missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via Specially crafted… | |
| CVE-2026-106170 | 13 Oct 2026 | CVSS 4.9 | Fortinet FortiSandboxAn Uncaught Exception vulnerability [CWE-248] vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6… | Fix |
| CVE-2026-106171 | 13 Oct 2026 | CVSS 6.1 | Fortinet FortiManagerA improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiManager 8.0.0… | Fix |
| CVE-2026-106172 | 13 Oct 2026 | CVSS 5.3 | Fortinet FortiSandboxA use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4… | Fix |
| CVE-2026-106173 | 13 Oct 2026 | CVSS 9.8 | Fortinet FortiSIEMA improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to… | |
| CVE-2026-106175 | 13 Oct 2026 | CVSS 2.3 | Fortinet FortiSwitchA Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.7, FortiOS 7.4 all versions, FortiOS 7.2 all versions… | Fix |
| CVE-2025-57739 | 13 Oct 2026 | CVSS 8.8 | Fortinet FortiMailAn improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet FortiMail… | |
| CVE-2025-46773 | 13 Oct 2026 | CVSS 8.8 | Fortinet FortiAnalyzer CloudAn Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet… | Fix |
| CVE-2026-104286 | 1 Oct 2026 | CVSS 9.8 | Unauthenticated file write in Fortinet FortiMailAn improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail… | ExploitedFix |
| CVE-2026-25089 | 9 Jun 2026 | CVSS 9.8 | Fortinet FortiSandbox OS Command InjectionA improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through… | Exploited |
| CVE-2026-39808 | 14 Apr 2026 | CVSS 9.8 | Fortinet FortiSandbox OS Command InjectionA improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through… | Exploited |
| CVE-2025-61624 | 14 Apr 2026 | CVSS 6.5 | Fortinet Multiple Products Path TraversalAn Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4… | Exploited |
| CVE-2026-35616 | 4 Apr 2026 | CVSS 9.8 | Fortinet FortiClient EMS Improper Access ControlA improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized… | ExploitedFix |
| CVE-2025-68686 | 10 Feb 2026 | CVSS 5.9 | Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized ActorAn Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS… | Exploited |
| CVE-2026-21643 | 6 Feb 2026 | CVSS 9.8 | Fortinet FortiClient EMS SQL InjectionAn improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an… | Exploited |
| CVE-2026-24858 | 27 Jan 2026 | CVSS 9.8 | Fortinet Multiple Products Authentication Bypass Using an Alternate Path or ChannelAn Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5… | Exploited |
| CVE-2025-25249 | 13 Jan 2026 | CVSS 9.8 | Fortinet Multiple Products Heap-based Buffer OverflowA heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11… | Exploited |
| CVE-2025-59718 | 9 Dec 2025 | CVSS 9.8 | Fortinet Multiple Products Improper Verification of Cryptographic SignatureA improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0… | Exploited |
| CVE-2025-58034 | 18 Nov 2025 | CVSS 7.2 | Fortinet FortiWeb OS Command InjectionAn Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet… | Exploited |
| CVE-2025-64446 | 14 Nov 2025 | CVSS 9.8 | Fortinet FortiWeb Path TraversalA relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9… | Exploited |
| CVE-2025-25257 | 17 Jul 2025 | CVSS 9.8 | Fortinet FortiWeb SQL InjectionAn improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb… | Exploited |
| CVE-2025-32756 | 13 May 2025 | CVSS 9.8 | Fortinet Multiple Products Stack-Based Buffer OverflowA stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions… | Exploited |
| CVE-2025-24472 | 11 Feb 2025 | CVSS 8.1 | Fortinet FortiOS and FortiProxy Authentication BypassAn Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0… | Exploited |
| CVE-2024-55591 | 14 Jan 2025 | CVSS 9.8 | Fortinet FortiOS and FortiProxy Authentication BypassAn Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy… | Exploited |
| CVE-2024-47575 | 23 Oct 2024 | CVSS 9.8 | Fortinet FortiManager Missing AuthenticationA missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7… | Exploited |
| CVE-2023-48788 | 12 Mar 2024 | CVSS 9.8 | Fortinet FortiClient EMS SQL InjectionA improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2… | Exploited |
| CVE-2023-48788 | 12 Mar 2024 | CVSS 9.8 | Fortinet FortiClient EMS SQL InjectionA improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2… | Exploited |
| CVE-2024-23113 | 15 Feb 2024 | CVSS 9.8 | Fortinet Multiple Products Format StringA use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy… | Exploited |
| CVE-2024-21762 | 9 Feb 2024 | CVSS 9.8 | Fortinet FortiOS Out-of-Bound WriteA out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.13, FortiOS 6.4.0… | Exploited |
| CVE-2023-27997 | 13 Jun 2023 | CVSS 9.8 | Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer OverflowA heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version… | Exploited |
| CVE-2022-41328 | 7 Mar 2023 | CVSS 7.1 | Fortinet FortiOS Path TraversalA improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 through… | Exploited |
| CVE-2022-42475 | 2 Jan 2023 | CVSS 9.8 | Fortinet FortiOS Heap-Based Buffer OverflowA heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through… | Exploited |
| CVE-2022-40684 | 18 Oct 2022 | CVSS 9.8 | Fortinet Multiple Products Authentication BypassAn authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6… | Exploited |
| CVE-2021-44168 | 4 Jan 2022 | CVSS 7.8 | Fortinet FortiOS Arbitrary File DownloadA download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local… | Exploited |
| CVE-2019-5591 | 14 Aug 2020 | CVSS 6.5 | Fortinet FortiOS Default ConfigurationA Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by… | Exploited |
| CVE-2020-12812 | 24 Jul 2020 | CVSS 9.8 | Fortinet FortiOS SSL VPN Improper AuthenticationAn improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in… | Exploited |
| CVE-2019-6693 | 21 Nov 2019 | CVSS 6.5 | Fortinet FortiOS Use of Hard-Coded CredentialsUse of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup… | Exploited |
| CVE-2018-13379 | 4 Jun 2019 | CVSS 9.8 | Fortinet FortiOS SSL VPN Path TraversalAn Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to… | Exploited |
| CVE-2018-13382 | 4 Jun 2019 | CVSS 7.5 | Fortinet FortiOS and FortiProxy Improper AuthorizationAn Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8… | Exploited |
| CVE-2018-13383 | 29 May 2019 | CVSS 6.5 | Fortinet FortiOS and FortiProxy Out-of-bounds WriteA heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0… | Exploited |
| CVE-2018-13374 | 22 Jan 2019 | CVSS 4.3 | Fortinet FortiOS and FortiADC Improper Access ControlA Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the… | Exploited |