Read the docs

Fortinet

Records1171All Threatist records
Exploited (KEV)32In CISA KEV
CVSS critical136CVSS 9.0–10.0
CVSS high431CVSS 7.0–8.9

Exploited now

Fortinet records in CISA KEV
TI-2025-38067 Fortinet Multiple Products Path Traversal Vulnerability Priority CRITICAL 88KEV 2026-10-16TI-2026-65779 Fortinet FortiMail Path Traversal Vulnerability Priority CRITICAL 100KEV 2026-10-01TI-2025-18911 Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability Priority CRITICAL 100KEV 2026-09-09TI-2025-42166 Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability Priority HIGH 81KEV 2026-07-27TI-2026-20264 Fortinet FortiSandbox OS Command Injection Vulnerability Priority CRITICAL 98KEV 2026-07-16TI-2026-28691 Fortinet FortiSandbox OS Command Injection Vulnerability Priority CRITICAL 98KEV 2026-07-16

Components

Products in the NVD configurations · select one to filter the records
Fortios 277 records CRITICAL Fortiweb 126 records CRITICAL Fortiproxy 125 records CRITICAL Fortimanager 113 records CRITICAL Fortianalyzer 92 records CRITICAL Forticlient 86 records MEDIUM Fortisandbox 60 records CRITICAL Fortimail 47 records CRITICAL

Records

17 records in Fortianalyzer Cloud · all components

TI-2024-33992 CVE-2024-50563 · GHSA-w3ph-4wxh-3hvv

Weak authentication in Fortinet FortiAnalyzer

Priority MEDIUM 49

A weak authentication in Fortinet FortiManager Cloud, FortiAnalyzer versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiAnalyzer Cloud versions 7.4.1 through 7.4.3, FortiManager versions 7.6.0 through 7.6.1, 7.4.1 th…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00574 Published 2025-01-16 No fix listed CWE-1390
TI-2024-32584 CVE-2024-48886 · GHSA-2mpq-2g57-j8ww

Weak authentication in Fortinet FortiOS

Priority MEDIUM 43

A weak authentication in Fortinet FortiOS versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, FortiProxy versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.10, 7.0.0 through 7.0.17…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00476 Published 2025-01-14 No fix listed CWE-1390
TI-2024-23337 CVE-2024-35276 · GHSA-p469-jgv4-q322

Stack-based buffer overflow in Fortinet FortiAnalyzer

Priority MEDIUM 42

A stack-based buffer overflow vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.3, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzer 7.0.0 through 7.0.12, FortiAnalyzer 6.4.0 through 6.4.14, FortiAnalyzer Cloud 7.…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00432 Published 2025-01-14 No fix listed CWE-121
TI-2024-23336 CVE-2024-35275 · GHSA-rp6x-j4c5-4rvc

SQL injection in Fortinet FortiManager

Priority MEDIUM 42

A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiAnalyzer version 7.4.0 through 7.4.2, FortiManager version 7.4.0 through 7.4.2 allows attacker to escalation of priv…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00843 Published 2025-01-14 No fix listed CWE-89
TI-2024-23334 CVE-2024-35273 · GHSA-gc47-55jm-w6mg

Out-of-bounds write in Fortinet FortiAnalyzer

Priority MEDIUM 41

A out-of-bounds write in Fortinet FortiManager version 7.4.0 through 7.4.2, FortiAnalyzer version 7.4.0 through 7.4.2 allows attacker to escalation of privilege via specially crafted http requests.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00682 Published 2025-01-14 No fix listed CWE-787
TI-2026-18339 CVE-2026-22828 · GHSA-9mp2-p73v-6v44

Heap-based buffer overflow in Fortinet FortiAnalyzer Cloud

Priority LOW 36

A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiManager Cloud 7.6.2 through 7.6.4 may allow a remote unauthenticated attacker to execute arbitrary code or commands via…

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00901 Published 2026-04-14 No fix listed CWE-122
TI-2024-27010 CVE-2024-40584 · GHSA-x763-rwjp-4g28

OS command injection in Fortinet FortiAnalyzer

Priority LOW 36

An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiAnalyzer version 7.4.0 through 7.4.3, 7.2.0 through 7.2.5, 7.0.0 through 7.0.13, 6.4.0…

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.02009 Published 2025-02-11 No fix listed CWE-78
TI-2024-30401 CVE-2024-45331 · GHSA-rjhh-4m39-v2cg

A incorrect privilege assignment vulnerability in Fortinet FortiAnalyzer 7.4.0 through…

Priority LOW 35

A incorrect privilege assignment vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.3, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all versions, FortiAnalyzer Cloud 7.4.1 t…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00207 Published 2025-01-16 No fix listed CWE-266
TI-2024-22096 CVE-2024-33503 · GHSA-hw72-fmxv-278r

A improper privilege management vulnerability in Fortinet FortiManager Cloud 7.4.1…

Priority LOW 35

A improper privilege management vulnerability in Fortinet FortiManager Cloud 7.4.1 through 7.4.3, FortiManager Cloud 7.2.1 through 7.2.5, FortiManager Cloud 7.0 all versions, FortiManager 7.4.0 through 7.4.3, FortiManage…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00216 Published 2025-01-14 No fix listed CWE-266
TI-2025-30728 CVE-2025-48418 · GHSA-pf26-74cx-2vmm

A hidden functionality vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.3…

Priority LOW 34

A hidden functionality vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.3, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2.0 through 7.2.10, FortiAnalyzer 7.0.0 through 7.0.14, FortiAnalyzer 6.4 all version…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0059 Published 2026-03-10 No fix listed CWE-912
TI-2025-42148 CVE-2025-68648 · GHSA-hvh3-476h-jj48

A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer…

Priority LOW 32

A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer C…

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00649 Published 2026-03-10 No fix listed CWE-134
TI-2024-34000 CVE-2024-50571 · GHSA-4gx4-5v9p-8rrm

Heap-based buffer overflow in Fortinet FortiManager

Priority LOW 32

A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.0 through 7.4.5, FortiAnalyzer 7.2.0 through 7.2.9, FortiAnalyzer 7.0.0 through 7.0.13, FortiAnalyzer 6.4 all ve…

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00536 Published 2025-10-14 No fix listed CWE-122
TI-2025-38234 CVE-2025-61848 · GHSA-p356-3hpr-4rhh

SQL injection in Fortinet FortiManager

Priority LOW 31

An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.8, FortiAnalyzer 7.2 all versions, Fort…

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00511 Published 2026-04-14 No fix listed CWE-89
TI-2025-42149 CVE-2025-68649 · GHSA-w5r2-jfhj-qppp

Path traversal in Fortinet FortiManager Cloud

Priority LOW 29

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnaly…

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00413 Published 2026-04-14 No fix listed CWE-22
TI-2025-18199 CVE-2025-24474 · GHSA-h86m-jj8c-794w

SQL injection in Fortinet FortiManager

Priority LOW 21

An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiManager 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, 7.2 all versions, 7.0 all versions, 6.4 all version…

CVSS 3.1LOW 2.6 Network High privileges No interaction EPSS 0.00312 Published 2025-07-08 No fix listed CWE-89
TI-2026-18190 CVE-2026-22629 · GHSA-qwch-jrh6-94wh

Missing brute-force protection in Fortinet FortiManager

Priority LOW 17

An improper restriction of excessive authentication attempts vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.10, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions…

CVSS 3.1LOW 3.4 Network No auth No interaction EPSS 0.00419 Published 2026-03-10 No fix listed CWE-307
Open these records in search →