Read the docs

Fortinet

Records1171All Threatist records
Exploited (KEV)32In CISA KEV
CVSS critical136CVSS 9.0–10.0
CVSS high431CVSS 7.0–8.9

Exploited now

Fortinet records in CISA KEV
TI-2025-38067 Fortinet Multiple Products Path Traversal Vulnerability Priority CRITICAL 88KEV 2026-10-16TI-2026-65779 Fortinet FortiMail Path Traversal Vulnerability Priority CRITICAL 100KEV 2026-10-01TI-2025-18911 Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability Priority CRITICAL 100KEV 2026-09-09TI-2025-42166 Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability Priority HIGH 81KEV 2026-07-27TI-2026-20264 Fortinet FortiSandbox OS Command Injection Vulnerability Priority CRITICAL 98KEV 2026-07-16TI-2026-28691 Fortinet FortiSandbox OS Command Injection Vulnerability Priority CRITICAL 98KEV 2026-07-16

Components

Products in the NVD configurations · select one to filter the records
Fortios 277 records CRITICAL Fortiweb 126 records CRITICAL Fortiproxy 125 records CRITICAL Fortimanager 113 records CRITICAL Fortianalyzer 92 records CRITICAL Forticlient 86 records MEDIUM Fortisandbox 60 records CRITICAL Fortimail 47 records CRITICAL

Records

125 records in Fortiproxy · all components

TI-2026-20057 CVE-2026-24858 · GHSA-2x38-48vp-w23x

Authentication bypass in Fortinet FortiWeb

Priority CRITICAL 100KEV

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, Fort…

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.86592 Published 2026-01-27 No fix listed CWE-288
TI-2024-36904 CVE-2024-55591 · GHSA-v4mr-pqhx-vpm2

Authentication bypass in Fortinet FortiOS

Priority CRITICAL 100KEV

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote atta…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.9435 Published 2025-01-14 No fix listed CWE-288
TI-2024-15234 CVE-2024-23113 · GHSA-57pf-f69p-p222

A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through…

Priority CRITICAL 100KEV

A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.61725 Published 2024-02-15 No fix listed CWE-134
TI-2024-14448 CVE-2024-21762 · GHSA-v4hq-m4wr-6pmj

Out-of-bounds write in Fortinet FortiOS

Priority CRITICAL 100KEV

A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.13, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, FortiOS 6.0 all versions…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.84589 Published 2024-02-09 No fix listed CWE-787
TI-2023-12585 CVE-2023-27997 · GHSA-2hj2-fcr9-9p35

Heap-based buffer overflow in Fortinet FortiOS-6K7K

Priority CRITICAL 100KEV

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.85689 Published 2023-06-13 No fix listed CWE-122
TI-2022-20674 CVE-2022-42475 · GHSA-p3vq-4cxh-gfp9

Out-of-bounds write in Fortinet FortiProxy

Priority CRITICAL 100KEV

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1,…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99474 Published 2023-01-02 No fix listed CWE-197
TI-2022-19321 CVE-2022-40684 · GHSA-m3wm-rjvf-m778

Improper authentication in Fortinet FortiOS, FortiProxy, FortiSwitchManager

Priority CRITICAL 100KEV

An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManag…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99984 Published 2022-10-18 No fix listed CWE-287
TI-2018-09616 CVE-2018-13379 · GHSA-2q79-m25p-r2q3

Path traversal in Fortinet FortiOS, FortiProxy

Priority CRITICAL 99KEV

An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99999 Published 2019-06-04 No fix listed CWE-22
TI-2025-37178 CVE-2025-59718 · GHSA-fjj2-p33c-f8qq

Improper signature verification in Fortinet FortiSwitchManager

Priority CRITICAL 98KEV

A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.68293 Published 2025-12-09 No fix listed CWE-347
TI-2018-09619 CVE-2018-13382 · GHSA-chg2-j3mj-m3rj

Incorrect authorization in Fortinet FortiOS, FortiProxy

Priority CRITICAL 98KEV

An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unaut…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.81691 Published 2019-06-04 No fix listed CWE-863
TI-2025-18197 CVE-2025-24472 · GHSA-rp3f-whm7-36hq

Authentication bypass in Fortinet FortiOS

Priority CRITICAL 94KEV

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated atta…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.07235 Published 2025-02-11 No fix listed CWE-288
TI-2025-38067 CVE-2025-61624 · GHSA-f3vf-64gv-cxr8

Path traversal in Fortinet FortiOS and other products

Priority CRITICAL 88KEV

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all ver…

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.01343 Published 2026-04-14 No fix listed CWE-22
TI-2018-09620 CVE-2018-13383 · GHSA-cjc8-2cq5-7jq7

Out-of-bounds write in Fortinet FortiOS and FortiProxy

Priority CRITICAL 86KEV

A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web s…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.32473 Published 2019-05-29 No fix listed CWE-787
TI-2023-10911 CVE-2023-25610 · GHSA-wvpr-v2qr-ccvf

A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of…

Priority HIGH 66

A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.6, version 6.4.0 through 6.4.11 and version 6.2.12 and bel…

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.18331 Published 2025-03-24 No fix listed CWE-124
TI-2018-09617 CVE-2018-13380 · GHSA-p6vg-vj3x-m483

Cross-site scripting in Fortinet FortiOS and FortiProxy

Priority MEDIUM 62

A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below and Fortinet FortiProxy 2.0.0, 1.2.8 and below under SSL VPN web portal allows attacker to exe…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.62474 Published 2019-06-04 No fix listed CWE-79
TI-2024-32582 CVE-2024-48884 · GHSA-qhwf-jg9m-cq9f

Path traversal in Fortinet FortiOS

Priority MEDIUM 61

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.1 through 7.4.3, FortiManager Cloud 7.4.1 through 7.4.3, Forti…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.15212 Published 2025-01-14 No fix listed CWE-22
TI-2023-22880 CVE-2023-42789 · GHSA-96vw-xpr8-777x

Out-of-bounds write in Fortinet FortiProxy

Priority MEDIUM 55

A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, FortiProxy 7.4.0, FortiP…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03306 Published 2024-03-12 No fix listed CWE-787
TI-2023-16467 CVE-2023-33308 · GHSA-h3gf-whgg-wh93

Stack-based buffer overflow in Fortinet FortiProxy

Priority MEDIUM 53

A stack-based overflow vulnerability [CWE-124] in Fortinet FortiOS version 7.0.0 through 7.0.10 and 7.2.0 through 7.2.3 and FortiProxy version 7.0.0 through 7.0.9 and 7.2.0 through 7.2.2 allows a remote unauthenticated a…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02121 Published 2023-07-26 No fix listed CWE-121
TI-2022-19827 CVE-2022-41331 · GHSA-6x2x-jvcm-q6gr

Missing authentication in Fortinet FortiPresence

Priority MEDIUM 51

A missing authentication for critical function vulnerability [CWE-306] in FortiPresence infrastructure server before version 1.2.1 allows a remote, unauthenticated attacker to access the Redis and MongoDB instances via c…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01275 Published 2023-04-11 No fix listed CWE-306
TI-2024-17109 CVE-2024-26011 · GHSA-gm6q-h79g-j9pf

Missing authentication in Fortinet FortiManager

Priority MEDIUM 49

A missing authentication for critical function vulnerability in Fortinet FortiManager 7.4.0 through 7.4.2, FortiManager 7.2.0 through 7.2.4, FortiManager 7.0.0 through 7.0.11, FortiManager 6.4.0 through 6.4.14, FortiOS 7…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00597 Published 2024-11-12 No fix listed CWE-306
TI-2022-16283 CVE-2022-35843 · GHSA-h7pw-vp92-fggq

Improper access control in Fortinet FortiOS

Priority MEDIUM 45

An authentication bypass by assumed-immutable data vulnerability [CWE-302] in the FortiOS SSH login component 7.2.0, 7.0.0 through 7.0.7, 6.4.0 through 6.4.9, 6.2 all versions, 6.0 all versions and FortiProxy SSH login c…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00947 Published 2022-12-06 No fix listed CWE-284
TI-2023-13610 CVE-2023-29180 · GHSA-wcp3-6xhg-h726

NULL pointer dereference in Fortinet FortiOS

Priority MEDIUM 44

A null pointer dereference vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4, FortiOS 7.0.0 through 7.0.11, FortiOS 6.4.0 through 6.4.12, FortiOS 6.2.0 through 6.2.14, FortiOS 6.0.0 through 6.0.16, FortiProxy 7.2.0 t…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.028 Published 2024-02-22 No fix listed CWE-476
TI-2025-16161 CVE-2025-22252 · GHSA-2w29-fw64-5ggm

Missing authentication in Fortinet FortiProxy

Priority MEDIUM 43

A missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager version 7.2.5, and FortiOS versions 7.4.4 through 7.4.6 and version 7.6.0 may allow an attacker with…

CVSS 3.1CRITICAL 9.0 Network No auth No interaction EPSS 0.00949 Published 2025-05-28 No fix listed CWE-306
TI-2024-32584 CVE-2024-48886 · GHSA-2mpq-2g57-j8ww

Weak authentication in Fortinet FortiOS

Priority MEDIUM 43

A weak authentication in Fortinet FortiOS versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, FortiProxy versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.10, 7.0.0 through 7.0.17…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00476 Published 2025-01-14 No fix listed CWE-1390
TI-2023-23776 CVE-2023-44250 · GHSA-mr34-2x5p-4cw8

Improper privilege management in Fortinet FortiOS

Priority MEDIUM 42

An improper privilege management vulnerability [CWE-269] in a Fortinet FortiOS HA cluster version 7.4.0 through 7.4.1 and 7.2.5 and in a FortiProxy HA cluster version 7.4.0 through 7.4.1 allows an authenticated attacker…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00899 Published 2024-01-10 No fix listed CWE-269
Load more
Open these records in search →