Read the docs

Fortinet

Records1171All Threatist records
Exploited (KEV)32In CISA KEV
CVSS critical136CVSS 9.0–10.0
CVSS high431CVSS 7.0–8.9

Exploited now

Fortinet records in CISA KEV
TI-2025-38067 Fortinet Multiple Products Path Traversal Vulnerability Priority CRITICAL 88KEV 2026-10-16TI-2026-65779 Fortinet FortiMail Path Traversal Vulnerability Priority CRITICAL 100KEV 2026-10-01TI-2025-18911 Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability Priority CRITICAL 100KEV 2026-09-09TI-2025-42166 Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability Priority HIGH 81KEV 2026-07-27TI-2026-20264 Fortinet FortiSandbox OS Command Injection Vulnerability Priority CRITICAL 98KEV 2026-07-16TI-2026-28691 Fortinet FortiSandbox OS Command Injection Vulnerability Priority CRITICAL 98KEV 2026-07-16

Components

Products in the NVD configurations · select one to filter the records
Fortios 277 records CRITICAL Fortiweb 126 records CRITICAL Fortiproxy 125 records CRITICAL Fortimanager 113 records CRITICAL Fortianalyzer 92 records CRITICAL Forticlient 86 records MEDIUM Fortisandbox 60 records CRITICAL Fortimail 47 records CRITICAL

Records

9 records in Fortisandbox Cloud · all components

TI-2026-20264 CVE-2026-25089 · GHSA-gw24-hwf5-92h2

OS command injection in Fortinet FortiSandbox

Priority CRITICAL 98KEV

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, Fo…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.76112 Published 2026-06-09 No fix listed CWE-78
TI-2026-21086 CVE-2026-26083 · GHSA-5cw8-3wjv-7mvq

Missing authorization in Fortinet FortiSandbox

Priority MEDIUM 49

A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.0 through 5.0.1, FortiSandbox Cloud 4.4.5 throug…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00733 Published 2026-05-12 No fix listed CWE-862
TI-2025-33603 CVE-2025-53679 · GHSA-g2jf-rc5w-j8rp

OS command injection in Fortinet FortiSandbox

Priority MEDIUM 46

An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSand…

CVSS 3.1MEDIUM 6.9 Network High privileges No interaction EPSS 0.12203 Published 2025-12-09 No fix listed CWE-78
TI-2024-36179 CVE-2024-54026 · GHSA-j6hj-9xq3-x536

SQL injection in Fortinet FortiSandbox

Priority LOW 38

An improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiSandbox 4.4.0 through 4.4.6, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all ver…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00418 Published 2025-03-11 No fix listed CWE-89
TI-2026-20891 CVE-2026-25836 · GHSA-4j52-3x46-3m7g

OS command injection in Fortinet FortiSandbox Cloud

Priority LOW 36

An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox Cloud 5.0.4, FortiSandbox PaaS 5.0.4 may allow a privileged attacker with super-admin p…

CVSS 3.1MEDIUM 6.7 Network High privileges No interaction EPSS 0.01958 Published 2026-03-10 No fix listed CWE-78
TI-2026-20772 CVE-2026-25691 · GHSA-j3x3-rc9w-wf4m

Path traversal in Fortinet FortiSandbox PaaS

Priority LOW 28

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox C…

CVSS 3.1MEDIUM 6.2 Network High privileges No interaction EPSS 0.00456 Published 2026-04-14 No fix listed CWE-22
TI-2025-38255 CVE-2025-61886 · GHSA-pr8g-5jxw-8fhj

Cross-site scripting in Fortinet FortiSandbox PaaS

Priority LOW 22

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.4, FortiSandbox PaaS 5.0.0 through 5.0.4 may allow a…

CVSS 3.1MEDIUM 4.9 Network No auth User interaction EPSS 0.00275 Published 2026-04-14 No fix listed CWE-79
TI-2026-28695 CVE-2026-39812 · GHSA-9q3x-6267-mffc

Cross-site scripting in Fortinet FortiSandbox

Priority LOW 19

A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSan…

CVSS 3.1MEDIUM 4.3 Network High privileges User interaction EPSS 0.00193 Published 2026-04-14 No fix listed CWE-79
TI-2026-21743 CVE-2026-27316 · GHSA-jp5m-x7cp-gj98

Insufficiently protected credentials in Fortinet FortiSandbox

Priority LOW 13

A insufficiently protected credentials vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4 all versions, FortiSandbox PaaS 23.4 all versions, FortiSandbox PaaS 23.3 all versions, FortiSandbox Paa…

CVSS 3.1LOW 2.5 Network High privileges No interaction EPSS 0.00305 Published 2026-04-14 No fix listed CWE-522
Open these records in search →