Read the docs

Fortinet

Records1171All Threatist records
Exploited (KEV)32In CISA KEV
CVSS critical136CVSS 9.0–10.0
CVSS high431CVSS 7.0–8.9

Exploited now

Fortinet records in CISA KEV
TI-2025-38067 Fortinet Multiple Products Path Traversal Vulnerability Priority CRITICAL 88KEV 2026-10-16TI-2026-65779 Fortinet FortiMail Path Traversal Vulnerability Priority CRITICAL 100KEV 2026-10-01TI-2025-18911 Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability Priority CRITICAL 100KEV 2026-09-09TI-2025-42166 Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability Priority HIGH 81KEV 2026-07-27TI-2026-20264 Fortinet FortiSandbox OS Command Injection Vulnerability Priority CRITICAL 98KEV 2026-07-16TI-2026-28691 Fortinet FortiSandbox OS Command Injection Vulnerability Priority CRITICAL 98KEV 2026-07-16

Components

Products in the NVD configurations · select one to filter the records
Fortios 277 records CRITICAL Fortiweb 126 records CRITICAL Fortiproxy 125 records CRITICAL Fortimanager 113 records CRITICAL Fortianalyzer 92 records CRITICAL Forticlient 86 records MEDIUM Fortisandbox 60 records CRITICAL Fortimail 47 records CRITICAL

Records

10 records in Fortiisolator · all components

TI-2020-05468 CVE-2020-6649 · GHSA-qxf7-8j2m-38vq

Insufficient session expiration in Fortinet FortiIsolator

Priority MEDIUM 52

An insufficient session expiration vulnerability in FortiNet's FortiIsolator version 2.0.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be ab…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01542 Published 2021-02-08 No fix listed CWE-613
TI-2024-36903 CVE-2024-55590 · GHSA-vx56-xwhw-6m46

OS command injection in Fortinet FortiIsolator

Priority MEDIUM 41

Multiple improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilities [CWE-78] in Fortinet FortiIsolator version 2.4.0 through 2.4.5 allows an authenticated attacker with at…

CVSS 3.1HIGH 8.6 Network Low privileges No interaction EPSS 0.01021 Published 2025-03-11 No fix listed CWE-78
TI-2024-22100 CVE-2024-33507 · GHSA-q59r-m5g9-6m54

Insufficient session expiration in Fortinet FortiIsolator

Priority MEDIUM 41

An insufficient session expiration vulnerability [CWE-613] and an incorrect authorization vulnerability [CWE-863] in FortiIsolator 2.4.0 through 2.4.4, 2.3 all versions, 2.2.0, 2.1 all versions, 2.0 all versions authenti…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00388 Published 2025-10-14 No fix listed CWE-613
TI-2022-06628 CVE-2022-22298 · GHSA-x3m3-jmrv-xc5r

OS command injection in Fortinet FortiIsolator

Priority LOW 36

A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiIsolator version 1.0.0, FortiIsolator version 1.1.0, FortiIsolator version 1.2.0 through 1.2.2, FortiIsolator…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00456 Published 2023-10-10 No fix listed CWE-78
TI-2024-36177 CVE-2024-54024 · GHSA-83g9-r3gv-pq9c

OS command injection in Fortinet FortiIsolator

Priority LOW 35

An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiIsolator before version 2.4.6 allows a privileged attacker with super-admin profile an…

CVSS 3.1HIGH 7.0 Network High privileges No interaction EPSS 0.01175 Published 2025-04-08 No fix listed CWE-78
TI-2024-36178 CVE-2024-54025 · GHSA-jr95-cvrj-r656

OS command injection in Fortinet FortiIsolator

Priority LOW 31

An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiIsolator CLI before version 2.4.6 allows a privileged attacker to execute unauthorized…

CVSS 3.1MEDIUM 6.5 Local High privileges No interaction EPSS 0.00454 Published 2025-04-08 No fix listed CWE-78
TI-2024-18397 CVE-2024-27779 · GHSA-m8h2-gg48-m54f

Insufficient session expiration in Fortinet FortiSandbox

Priority LOW 31

An insufficient session expiration vulnerability [CWE-613] in FortiSandbox FortiSandbox version 4.4.4 and below, version 4.2.6 and below, 4.0 all versions, 3.2 all versions and FortiIsolator version 2.4 and below, 2.3 al…

CVSS 3.1MEDIUM 6.3 Network High privileges No interaction EPSS 0.00565 Published 2025-07-18 No fix listed CWE-613
TI-2020-05463 CVE-2020-6643 · GHSA-6g87-8hrf-rf58

Cross-site scripting in Fortinet FortiIsolator

Priority LOW 26

An improper neutralization of input vulnerability in the URL Description in Fortinet FortiIsolator version 1.2.2 allows a remote authenticated attacker to perform a cross site scripting attack (XSS).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0084 Published 2020-03-12 No fix listed CWE-79
TI-2024-21199 CVE-2024-32124 · GHSA-q3ww-hc8h-pvwj

Improper access control in Fortinet FortiIsolator

Priority LOW 19

An improper access control vulnerability [CWE-284] in FortiIsolator version 2.4.4, version 2.4.3, 2.3 all versions logging component may allow a remote authenticated read-only attacker to alter logs via a crafted HTTP re…

CVSS 3.1MEDIUM 4.0 Network Low privileges No interaction EPSS 0.00392 Published 2025-07-18 No fix listed CWE-284
Open these records in search →