Read the docs

Fortinet

Records1171All Threatist records
Exploited (KEV)32In CISA KEV
CVSS critical136CVSS 9.0–10.0
CVSS high431CVSS 7.0–8.9

Exploited now

Fortinet records in CISA KEV
TI-2025-38067 Fortinet Multiple Products Path Traversal Vulnerability Priority CRITICAL 88KEV 2026-10-16TI-2026-65779 Fortinet FortiMail Path Traversal Vulnerability Priority CRITICAL 100KEV 2026-10-01TI-2025-18911 Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability Priority CRITICAL 100KEV 2026-09-09TI-2025-42166 Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability Priority HIGH 81KEV 2026-07-27TI-2026-20264 Fortinet FortiSandbox OS Command Injection Vulnerability Priority CRITICAL 98KEV 2026-07-16TI-2026-28691 Fortinet FortiSandbox OS Command Injection Vulnerability Priority CRITICAL 98KEV 2026-07-16

Components

Products in the NVD configurations · select one to filter the records
Fortios 277 records CRITICAL Fortiweb 126 records CRITICAL Fortiproxy 125 records CRITICAL Fortimanager 113 records CRITICAL Fortianalyzer 92 records CRITICAL Forticlient 86 records MEDIUM Fortisandbox 60 records CRITICAL Fortimail 47 records CRITICAL

Records

28 records in Fortipam · all components

TI-2024-15234 CVE-2024-23113 · GHSA-57pf-f69p-p222

A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through…

Priority CRITICAL 100KEV

A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.61725 Published 2024-02-15 No fix listed CWE-134
TI-2025-38067 CVE-2025-61624 · GHSA-f3vf-64gv-cxr8

Path traversal in Fortinet FortiOS and other products

Priority CRITICAL 88KEV

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all ver…

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.01343 Published 2026-04-14 No fix listed CWE-22
TI-2024-17109 CVE-2024-26011 · GHSA-gm6q-h79g-j9pf

Missing authentication in Fortinet FortiManager

Priority MEDIUM 49

A missing authentication for critical function vulnerability in Fortinet FortiManager 7.4.0 through 7.4.2, FortiManager 7.2.0 through 7.2.4, FortiManager 7.0.0 through 7.0.11, FortiManager 6.4.0 through 6.4.14, FortiOS 7…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00602 Published 2024-11-12 No fix listed CWE-306
TI-2025-31268 CVE-2025-49201 · GHSA-45jf-r23j-3xm6

Weak authentication in Fortinet FortiPAM

Priority MEDIUM 44

A weak authentication vulnerability in Fortinet FortiPAM 1.5.0, FortiPAM 1.4.0 through 1.4.2, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiSwitchManager…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0058 Published 2025-10-14 No fix listed CWE-1390
TI-2023-22102 CVE-2023-41678 · GHSA-mp7x-6p2g-hmwv

Double free in Fortinet FortiOS

Priority MEDIUM 42

A double free in Fortinet FortiOS versions 7.0.0 through 7.0.5, FortiPAM version 1.0.0 through 1.0.3, 1.1.0 through 1.1.1 allows attacker to execute unauthorized code or commands via specifically crafted request.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01068 Published 2023-12-13 No fix listed CWE-415
TI-2025-35633 CVE-2025-57740 · GHSA-246v-8qgx-g3wc

Heap-based buffer overflow in Fortinet FortiPAM

Priority MEDIUM 41

An Heap-based Buffer Overflow vulnerability [CWE-122] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions; FortiPAM version 1.5.0, version 1.4.2 and b…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00697 Published 2025-10-14 No fix listed CWE-122
TI-2023-13611 CVE-2023-29181 · GHSA-h49p-33vw-q6xw

A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.2.0…

Priority MEDIUM 41

A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4, FortiOS 7.0.0 through 7.0.11, FortiOS 6.4.0 through 6.4.12, FortiOS 6.2.0 through 6.2.14, FortiOS 6.0.0 through 6.0.16,…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00724 Published 2024-02-22 No fix listed CWE-134
TI-2023-18456 CVE-2023-36639 · GHSA-rhfj-295m-9hhj

A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0…

Priority MEDIUM 40

A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, FortiOS versions 7.4.0, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 throu…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01059 Published 2023-12-13 No fix listed CWE-134
TI-2024-17107 CVE-2024-26009 · GHSA-g3r6-2cv3-63vw

Authentication bypass in Fortinet FortiProxy

Priority LOW 39

An authentication bypass using an alternate path or channel [CWE-288] vulnerability in Fortinet FortiOS 6.4.0 through 6.4.15, FortiOS 6.2.0 through 6.2.16, FortiOS 6.0 all versions, FortiPAM 1.2.0, FortiPAM 1.1.0 through…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00774 Published 2025-08-12 No fix listed CWE-288
TI-2025-16163 CVE-2025-22256 · GHSA-5xp9-26pv-gh7v

A improper handling of insufficient permissions or privileges in Fortinet FortiPAM 1.4.0…

Priority LOW 38

A improper handling of insufficient permissions or privileges in Fortinet FortiPAM 1.4.0 through 1.4.1, 1.3.0, 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSRA 1.4.0 through 1.4.1 allows attacker to improper acc…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00387 Published 2025-06-10 No fix listed CWE-280
TI-2022-22664 CVE-2022-45862 · GHSA-ggw5-pfvx-r7j9

Insufficient session expiration in Fortinet FortiPAM

Priority LOW 38

An insufficient session expiration vulnerability [CWE-613] vulnerability in FortiOS 7.2.5 and below, 7.0 all versions, 6.4 all versions; FortiProxy 7.2 all versions, 7.0 all versions; FortiPAM 1.3 all versions, 1.2 all v…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00447 Published 2024-08-13 No fix listed CWE-613
TI-2024-17108 CVE-2024-26010 · GHSA-f58x-r563-jp48

Stack-based buffer overflow in Fortinet FortiOS

Priority LOW 36

A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.3, FortiOS 7.2.0 through 7.2.7, FortiOS 7.0.0 through 7.0.14, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions…

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.00786 Published 2024-06-11 No fix listed CWE-121
TI-2023-24388 CVE-2023-45584 · GHSA-cqjp-8gg8-rwv9

Double free in Fortinet FortiProxy

Priority LOW 35

A double free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, Fo…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0064 Published 2025-08-12 No fix listed CWE-415
TI-2023-24387 CVE-2023-45583 · GHSA-q467-67pv-7pmf

A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0…

Priority LOW 35

A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiPAM 1.1.0, FortiPAM 1.…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00659 Published 2024-05-14 No fix listed CWE-134
TI-2025-16164 CVE-2025-22258 · GHSA-5hxp-wcvm-357w

Heap-based buffer overflow in Fortinet FortiPAM

Priority LOW 34

A heap-based buffer overflow in Fortinet FortiSRA 1.5.0, 1.4.0 through 1.4.2, FortiPAM 1.5.0, 1.4.0 through 1.4.2, 1.3.0 through 1.3.1, 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiProxy 7.6.0 through 7.6.1, 7.4…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00556 Published 2025-10-14 No fix listed CWE-122
TI-2024-30394 CVE-2024-45324 · GHSA-gffv-9cg4-8hh4

A use of externally-controlled format string vulnerability [CWE-134] in FortiOS version…

Priority LOW 34

A use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.0 through 7.4.4, version 7.2.0 through 7.2.9, version 7.0.0 through 7.0.15 and before 6.4.15, FortiProxy version 7.4.0 through 7…

CVSS 3.1HIGH 7.0 Network High privileges No interaction EPSS 0.00729 Published 2025-03-11 No fix listed CWE-134
TI-2024-31854 CVE-2024-47570 · GHSA-fgjc-2w92-q899

Sensitive information in log files in Fortinet FortiSASE

Priority LOW 31

An insertion of sensitive information into log file vulnerability [CWE-532] in FortiOS 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0 all versions; FortiProxy 7.4.0 through 7.4.3, 7.2.0 through 7.2.11; FortiPAM 1.4 all ve…

CVSS 3.1MEDIUM 6.6 Network High privileges No interaction EPSS 0.00405 Published 2025-12-09 No fix listed CWE-532
TI-2023-18457 CVE-2023-36640 · GHSA-r7v6-m227-rm4x

A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0…

Priority LOW 31

A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0.0 through 6.0.1…

CVSS 3.1MEDIUM 6.7 Local High privileges No interaction EPSS 0.0028 Published 2024-05-14 No fix listed CWE-134
TI-2026-42653 CVE-2026-59837 · GHSA-wxrh-6ch6-6hp4

Stack-based buffer overflow in Fortinet FortiOS

Priority LOW 30

A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.8.0 through 1.8.2, FortiPAM 1.7 all versions,…

CVSS 3.1MEDIUM 5.9 Network High privileges No interaction EPSS 0.0067 Published 2026-07-14 No fix listed CWE-121
TI-2024-17106 CVE-2024-26008 · GHSA-qh97-826g-4v22

Improper check for unusual conditions in Fortinet FortiProxy

Priority LOW 30

An improper check or handling of exceptional conditions vulnerability [CWE-703] in FortiOS version 7.4.0 through 7.4.3 and before 7.2.7, FortiProxy version 7.4.0 through 7.4.3 and before 7.2.9, FortiPAM before 1.2.0 and…

CVSS 3.1MEDIUM 5.0 Network No auth No interaction EPSS 0.00576 Published 2025-10-14 No fix listed CWE-754
TI-2023-19367 CVE-2023-37934 · GHSA-c68r-72rr-cx8r

Resource allocation without limits in Fortinet FortiPAM

Priority LOW 30

An allocation of resources without limits or throttling vulnerability [CWE-770] in FortiPAM 1.0 all versions allows an authenticated attacker to perform a denial of service attack via sending crafted HTTP or HTTPS reques…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00587 Published 2024-01-10 No fix listed CWE-770
TI-2025-18910 CVE-2025-25248 · GHSA-f257-v2jp-hg34

Integer overflow in Fortinet FortiOS

Priority LOW 29

An Integer Overflow or Wraparound vulnerability [CWE-190] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, 7.2 all versions, 6.4 all versions, FortiProxy version 7.6.2 and below, ver…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00515 Published 2025-08-12 No fix listed CWE-190
TI-2026-18994 CVE-2026-23573 · GHSA-7r2p-wwg4-j6v8

Cross-site scripting in Fortinet FortiOS

Priority LOW 27

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4 all versions, FortiOS 7.2 all versions, Fo…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00385 Published 2026-07-14 No fix listed CWE-79
TI-2025-34575 CVE-2025-54821 · GHSA-hg7x-vp9f-fjh2

Improper privilege management in Fortinet FortiOS

Priority LOW 26

An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.11, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions,…

CVSS 3.1MEDIUM 6.0 Local High privileges No interaction EPSS 0.00185 Published 2025-11-18 No fix listed CWE-269
Load more
Open these records in search →