Read the docs

Fortinet

Records1171All Threatist records
Exploited (KEV)32In CISA KEV
CVSS critical136CVSS 9.0–10.0
CVSS high431CVSS 7.0–8.9

Exploited now

Fortinet records in CISA KEV
TI-2025-38067 Fortinet Multiple Products Path Traversal Vulnerability Priority CRITICAL 88KEV 2026-10-16TI-2026-65779 Fortinet FortiMail Path Traversal Vulnerability Priority CRITICAL 100KEV 2026-10-01TI-2025-18911 Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability Priority CRITICAL 100KEV 2026-09-09TI-2025-42166 Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability Priority HIGH 81KEV 2026-07-27TI-2026-20264 Fortinet FortiSandbox OS Command Injection Vulnerability Priority CRITICAL 98KEV 2026-07-16TI-2026-28691 Fortinet FortiSandbox OS Command Injection Vulnerability Priority CRITICAL 98KEV 2026-07-16

Components

Products in the NVD configurations · select one to filter the records
Fortios 277 records CRITICAL Fortiweb 126 records CRITICAL Fortiproxy 125 records CRITICAL Fortimanager 113 records CRITICAL Fortianalyzer 92 records CRITICAL Forticlient 86 records MEDIUM Fortisandbox 60 records CRITICAL Fortimail 47 records CRITICAL

Records

19 records in Fortiswitchmanager · all components

TI-2025-18911 CVE-2025-25249 · GHSA-mj8x-m8f5-x4w8

Heap-based buffer overflow in Fortinet FortiSwitchManager

Priority CRITICAL 100KEV

A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03742 Published 2026-01-13 No fix listed CWE-122
TI-2024-15234 CVE-2024-23113 · GHSA-57pf-f69p-p222

A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through…

Priority CRITICAL 100KEV

A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.61725 Published 2024-02-15 No fix listed CWE-134
TI-2022-19321 CVE-2022-40684 · GHSA-m3wm-rjvf-m778

Improper authentication in Fortinet FortiOS, FortiProxy, FortiSwitchManager

Priority CRITICAL 100KEV

An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManag…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99984 Published 2022-10-18 No fix listed CWE-287
TI-2025-37178 CVE-2025-59718 · GHSA-fjj2-p33c-f8qq

Improper signature verification in Fortinet FortiSwitchManager

Priority CRITICAL 98KEV

A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.68293 Published 2025-12-09 No fix listed CWE-347
TI-2025-38067 CVE-2025-61624 · GHSA-f3vf-64gv-cxr8

Path traversal in Fortinet FortiOS and other products

Priority CRITICAL 88KEV

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all ver…

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.01343 Published 2026-04-14 No fix listed CWE-22
TI-2023-10911 CVE-2023-25610 · GHSA-wvpr-v2qr-ccvf

A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of…

Priority HIGH 66

A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.6, version 6.4.0 through 6.4.11 and version 6.2.12 and bel…

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.18331 Published 2025-03-24 No fix listed CWE-124
TI-2024-17109 CVE-2024-26011 · GHSA-gm6q-h79g-j9pf

Missing authentication in Fortinet FortiManager

Priority MEDIUM 49

A missing authentication for critical function vulnerability in Fortinet FortiManager 7.4.0 through 7.4.2, FortiManager 7.2.0 through 7.2.4, FortiManager 7.0.0 through 7.0.11, FortiManager 6.4.0 through 6.4.14, FortiOS 7…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00597 Published 2024-11-12 No fix listed CWE-306
TI-2025-31268 CVE-2025-49201 · GHSA-45jf-r23j-3xm6

Weak authentication in Fortinet FortiPAM

Priority MEDIUM 44

A weak authentication vulnerability in Fortinet FortiPAM 1.5.0, FortiPAM 1.4.0 through 1.4.2, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiSwitchManager…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0058 Published 2025-10-14 No fix listed CWE-1390
TI-2025-16161 CVE-2025-22252 · GHSA-2w29-fw64-5ggm

Missing authentication in Fortinet FortiProxy

Priority MEDIUM 43

A missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager version 7.2.5, and FortiOS versions 7.4.4 through 7.4.6 and version 7.6.0 may allow an attacker with…

CVSS 3.1CRITICAL 9.0 Network No auth No interaction EPSS 0.00949 Published 2025-05-28 No fix listed CWE-306
TI-2022-19830 CVE-2022-41335 · GHSA-gjq5-3p29-m546

Path traversal in Fortinet FortiSwitchManager

Priority MEDIUM 41

A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.10, FortiProxy version 7.2.0 through 7.2.1, 7.0.0 through 7.0.7 and before 2.0.10, Fort…

CVSS 3.1HIGH 8.6 Network Low privileges No interaction EPSS 0.00927 Published 2023-02-16 No fix listed CWE-23
TI-2024-17107 CVE-2024-26009 · GHSA-g3r6-2cv3-63vw

Authentication bypass in Fortinet FortiProxy

Priority LOW 39

An authentication bypass using an alternate path or channel [CWE-288] vulnerability in Fortinet FortiOS 6.4.0 through 6.4.15, FortiOS 6.2.0 through 6.2.16, FortiOS 6.0 all versions, FortiPAM 1.2.0, FortiPAM 1.1.0 through…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00774 Published 2025-08-12 No fix listed CWE-288
TI-2022-22664 CVE-2022-45862 · GHSA-ggw5-pfvx-r7j9

Insufficient session expiration in Fortinet FortiPAM

Priority LOW 38

An insufficient session expiration vulnerability [CWE-613] vulnerability in FortiOS 7.2.5 and below, 7.0 all versions, 6.4 all versions; FortiProxy 7.2 all versions, 7.0 all versions; FortiPAM 1.3 all versions, 1.2 all v…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00443 Published 2024-08-13 No fix listed CWE-613
TI-2024-17108 CVE-2024-26010 · GHSA-f58x-r563-jp48

Stack-based buffer overflow in Fortinet FortiOS

Priority LOW 36

A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.3, FortiOS 7.2.0 through 7.2.7, FortiOS 7.0.0 through 7.0.14, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions…

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.00786 Published 2024-06-11 No fix listed CWE-121
TI-2023-24387 CVE-2023-45583 · GHSA-q467-67pv-7pmf

A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0…

Priority LOW 35

A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiPAM 1.1.0, FortiPAM 1.…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00659 Published 2024-05-14 No fix listed CWE-134
TI-2025-16164 CVE-2025-22258 · GHSA-5hxp-wcvm-357w

Heap-based buffer overflow in Fortinet FortiPAM

Priority LOW 34

A heap-based buffer overflow in Fortinet FortiSRA 1.5.0, 1.4.0 through 1.4.2, FortiPAM 1.5.0, 1.4.0 through 1.4.2, 1.3.0 through 1.3.1, 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiProxy 7.6.0 through 7.6.1, 7.4…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00556 Published 2025-10-14 No fix listed CWE-122
TI-2023-18453 CVE-2023-36635 · GHSA-h8ww-c8wr-cp22

Improper access control in Fortinet FortiSwitchManager

Priority LOW 31

An improper access control in Fortinet FortiSwitchManager version 7.2.0 through 7.2.2 7.0.0 through 7.0.1 may allow a remote authenticated read-only user to modify the interface settings via the API.

CVSS 3.1MEDIUM 6.9 Network Low privileges No interaction EPSS 0.00504 Published 2023-09-07 No fix listed CWE-284
TI-2024-17106 CVE-2024-26008 · GHSA-qh97-826g-4v22

Improper check for unusual conditions in Fortinet FortiProxy

Priority LOW 30

An improper check or handling of exceptional conditions vulnerability [CWE-703] in FortiOS version 7.4.0 through 7.4.3 and before 7.2.7, FortiProxy version 7.4.0 through 7.4.3 and before 7.2.9, FortiPAM before 1.2.0 and…

CVSS 3.1MEDIUM 5.0 Network No auth No interaction EPSS 0.00576 Published 2025-10-14 No fix listed CWE-754
TI-2022-20673 CVE-2022-42474 · GHSA-r533-5559-j96c

Path traversal in Fortinet FortiSwitchManager

Priority LOW 29

A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9 and before 6.4.12, FortiProxy version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.7, FortiSwitch…

CVSS 3.1MEDIUM 6.2 Network High privileges No interaction EPSS 0.00642 Published 2023-06-13 No fix listed CWE-23
Open these records in search →