Read the docs

Fortinet

Records1171All Threatist records
Exploited (KEV)32In CISA KEV
CVSS critical136CVSS 9.0–10.0
CVSS high431CVSS 7.0–8.9

Exploited now

Fortinet records in CISA KEV
TI-2025-38067 Fortinet Multiple Products Path Traversal Vulnerability Priority CRITICAL 88KEV 2026-10-16TI-2026-65779 Fortinet FortiMail Path Traversal Vulnerability Priority CRITICAL 100KEV 2026-10-01TI-2025-18911 Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability Priority CRITICAL 100KEV 2026-09-09TI-2025-42166 Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability Priority HIGH 81KEV 2026-07-27TI-2026-20264 Fortinet FortiSandbox OS Command Injection Vulnerability Priority CRITICAL 98KEV 2026-07-16TI-2026-28691 Fortinet FortiSandbox OS Command Injection Vulnerability Priority CRITICAL 98KEV 2026-07-16

Components

Products in the NVD configurations · select one to filter the records
Fortios 277 records CRITICAL Fortiweb 126 records CRITICAL Fortiproxy 125 records CRITICAL Fortimanager 113 records CRITICAL Fortianalyzer 92 records CRITICAL Forticlient 86 records MEDIUM Fortisandbox 60 records CRITICAL Fortimail 47 records CRITICAL

Records

30 records in Fortinac · all components

TI-2022-18918 CVE-2022-39952 · GHSA-4wjq-4wff-qw9c

Exposure of resource to wrong sphere in Fortinet FortiNAC

Priority CRITICAL 94

A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99794 Published 2023-02-16 No fix listed CWE-73
TI-2023-16458 CVE-2023-33299 · GHSA-2j65-72jp-x2mj

Deserialization of untrusted data in Fortinet FortiNAC

Priority HIGH 70

A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier versions of 8.x allows attacker to execute unauthorized code or commands via specifically crafted request on…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.24296 Published 2023-06-23 No fix listed CWE-502
TI-2022-18002 CVE-2022-38375 · GHSA-pxw3-v724-g6xr

Improper authorization in Fortinet FortiNAC

Priority MEDIUM 50

An improper authorization vulnerability [CWE-285] in Fortinet FortiNAC version 9.4.0 through 9.4.1 and before 9.2.6 allows an unauthenticated user to perform some administrative operations over the FortiNAC instance via…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01079 Published 2023-02-16 No fix listed CWE-285
TI-2022-18920 CVE-2022-39954 · GHSA-6g49-f785-8862

XML external entity injection in Fortinet FortiNAC

Priority MEDIUM 46

An improper restriction of xml external entity reference in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.2.7, FortiNAC version 9.1.0 through 9.1.8, FortiNAC version 8.8.0 through 8.8.11…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00548 Published 2023-02-16 No fix listed CWE-611
TI-2024-20852 CVE-2024-31488 · GHSA-2rj3-2h3h-5h64

Cross-site scripting in Fortinet FortiNAC

Priority MEDIUM 43

An improper neutralization of inputs during web page generation vulnerability [CWE-79] in FortiNAC version 9.4.0 through 9.4.4, 9.2.0 through 9.2.8, 9.1.0 through 9.1.10, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 7.2.0…

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.01014 Published 2024-05-14 No fix listed CWE-79
TI-2023-16459 CVE-2023-33300 · GHSA-5jp2-5x2p-j8xr

Command injection in Fortinet FortiNAC

Priority MEDIUM 43

A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiNAC 7.2.1 and earlier, 9.4.3 and earlier allows attacker a limited, unauthorized file access via specifically crafted…

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.1405 Published 2025-03-14 No fix listed CWE-77
TI-2023-08814 CVE-2023-22637 · GHSA-fjx8-gmr3-vg45

Cross-site scripting in Fortinet FortiNAC

Priority MEDIUM 42

An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all ve…

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.0061 Published 2023-05-03 No fix listed CWE-79
TI-2022-09580 CVE-2022-26116 · GHSA-86m5-hr8h-6w5v

SQL injection in Fortinet FortiNAC

Priority MEDIUM 42

Multiple improper neutralization of special elements used in SQL commands ('SQL Injection') vulnerability [CWE-89] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00833 Published 2022-05-11 No fix listed CWE-89
TI-2022-19314 CVE-2022-40677 · GHSA-jrrp-wvgf-hmfr

A improper neutralization of argument delimiters in a command ('argument injection') in…

Priority MEDIUM 41

A improper neutralization of argument delimiters in a command ('argument injection') in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00772 Published 2023-02-16 No fix listed CWE-88
TI-2023-08811 CVE-2023-22633 · GHSA-9gr9-452c-98q9

Access control flaw in Fortinet FortiNAC

Priority MEDIUM 40

An improper permissions, privileges, and access controls vulnerability [CWE-264] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.0 all versions 8.7.0 all versions may allow an unauthe…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00654 Published 2023-06-13 No fix listed CWE-264
TI-2022-21595 CVE-2022-43951 · GHSA-7824-x6vq-p8mj

Information disclosure in Fortinet FortiNAC

Priority MEDIUM 40

An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.11 and below, 8.7.6 and below may allow an unauthenticated attacker…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00593 Published 2023-04-11 No fix listed CWE-200
TI-2022-22662 CVE-2022-45860 · GHSA-6r8m-7q26-8wcc

Weak authentication in Fortinet FortiNAC

Priority LOW 39

A weak authentication vulnerability [CWE-1390] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions in device registration page may allow a…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00488 Published 2023-05-03 No fix listed CWE-1390
TI-2022-19312 CVE-2022-40675 · GHSA-66q7-rr79-fw65

Cryptographic flaw in Fortinet FortiNAC

Priority LOW 39

Some cryptographic issues in Fortinet FortiNAC versions 9.4.0 through 9.4.1, 9.2.0 through 9.2.7, 9.1.0 through 9.1.8, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow…

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00385 Published 2023-02-16 No fix listed CWE-310
TI-2021-19128 CVE-2021-43065

Incorrect permission assignment in Fortinet FortiNAC

Priority LOW 36

A incorrect permission assignment for critical resource in Fortinet FortiNAC version 9.2.0, version 9.1.3 and below, version 8.8.9 and below allows attacker to gain higher privileges via the access to sensitive system da…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00441 Published 2021-12-09 No fix listed CWE-732
TI-2023-11384 CVE-2023-26203 · GHSA-4pj9-45vq-jvvh

Hard-coded credentials in Fortinet FortiNAC

Priority LOW 35

A use of hard-coded credentials vulnerability [CWE-798] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions may allow an authenticated att…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00164 Published 2023-05-03 No fix listed CWE-798
TI-2022-19315 CVE-2022-40678 · GHSA-7pc3-hj79-39qj

Insufficiently protected credentials in Fortinet FortiNAC

Priority LOW 35

An insufficiently protected credentials in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00142 Published 2023-02-16 No fix listed CWE-522
TI-2022-18919 CVE-2022-39953 · GHSA-p6h3-h8g8-59fx

Improper privilege management in Fortinet FortiNAC

Priority LOW 35

A improper privilege management in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.2.6, FortiNAC version 9.1.0 through 9.1.8, FortiNAC all versions 8.8, FortiNAC all versions 8.7, FortiNAC…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00207 Published 2023-03-07 No fix listed CWE-269
TI-2022-19313 CVE-2022-40676 · GHSA-6c4j-vvvq-q626

Cross-site scripting in Fortinet FortiNAC

Priority LOW 34

A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.8, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 throu…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00514 Published 2023-03-07 No fix listed CWE-79
TI-2022-18912 CVE-2022-39946 · GHSA-46mg-x8hq-xrw5

Improper access control in Fortinet FortiNAC

Priority LOW 33

An access control vulnerability [CWE-284] in FortiNAC version 9.4.2 and below, version 9.2.7 and below, 9.1 all versions, 8.8 all versions, 8.7 all versions, 8.6 all versions, 8.5 all versions may allow a remote attacker…

CVSS 3.1HIGH 7.2 Network Low privileges No interaction EPSS 0.00717 Published 2023-06-13 No fix listed CWE-284
TI-2023-08815 CVE-2023-22638 · GHSA-2gg9-87cr-qr23

Cross-site scripting in Fortinet FortiNAC

Priority LOW 32

Several improper neutralization of inputs during web page generation vulnerability [CWE-79] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.11 and below, 8.7.6 and below, 8.6.5 and below, 8.5.4 and bel…

CVSS 3.1MEDIUM 6.7 Network Low privileges User interaction EPSS 0.00462 Published 2023-02-16 No fix listed CWE-79
TI-2022-22660 CVE-2022-45858 · GHSA-fxjv-92h2-p845

Broken or risky cryptographic algorithm in Fortinet FortiNAC

Priority LOW 32

A use of a weak cryptographic algorithm vulnerability [CWE-327] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.0 all versions, 8.8.0 all versions, 8.7.0 all versions may increase the chances of an attacker to have acc…

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00204 Published 2023-05-03 No fix listed CWE-327
TI-2023-11387 CVE-2023-26206 · GHSA-rx77-gfqm-pxj9

Cross-site scripting in Fortinet FortiNAC

Priority LOW 30

An improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiNAC 9.4.0 - 9.4.2, 9.2.0 - 9.2.8, 9.1.0 - 9.1.10 and 7.2.0 allows an attacker to execute unauthorized code or comma…

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.00472 Published 2024-02-15 No fix listed CWE-79
Load more
Open these records in search →