Read the docs

Fortinet

Records1171All Threatist records
Exploited (KEV)32In CISA KEV
CVSS critical136CVSS 9.0–10.0
CVSS high431CVSS 7.0–8.9

Exploited now

Fortinet records in CISA KEV
TI-2025-38067 Fortinet Multiple Products Path Traversal Vulnerability Priority CRITICAL 88KEV 2026-10-16TI-2026-65779 Fortinet FortiMail Path Traversal Vulnerability Priority CRITICAL 100KEV 2026-10-01TI-2025-18911 Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability Priority CRITICAL 100KEV 2026-09-09TI-2025-42166 Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability Priority HIGH 81KEV 2026-07-27TI-2026-20264 Fortinet FortiSandbox OS Command Injection Vulnerability Priority CRITICAL 98KEV 2026-07-16TI-2026-28691 Fortinet FortiSandbox OS Command Injection Vulnerability Priority CRITICAL 98KEV 2026-07-16

Components

Products in the NVD configurations · select one to filter the records
Fortios 277 records CRITICAL Fortiweb 126 records CRITICAL Fortiproxy 125 records CRITICAL Fortimanager 113 records CRITICAL Fortianalyzer 92 records CRITICAL Forticlient 86 records MEDIUM Fortisandbox 60 records CRITICAL Fortimail 47 records CRITICAL

Records

23 records in Fortiwlm · all components

TI-2023-17480 CVE-2023-34991 · GHSA-hg7c-7628-52r9

SQL injection in Fortinet FortiWLM

Priority HIGH 72

A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 and 8.4.0 through 8.4.2 and 8.3.0 through 8.3.2 and 8.2.2 al…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.28783 Published 2023-11-14 No fix listed CWE-89
TI-2023-17479 CVE-2023-34990 · GHSA-2pp3-2hr3-936m

Path traversal in Fortinet FortiWLM

Priority HIGH 70

A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specially crafted web requests.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.25038 Published 2024-12-18 No fix listed CWE-23
TI-2023-17482 CVE-2023-34993 · GHSA-hp4r-wh6m-675v

OS command injection in Fortinet FortiWLM

Priority HIGH 68

A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or comman…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.21321 Published 2023-10-10 No fix listed CWE-78
TI-2023-18385 CVE-2023-36550 · GHSA-92rr-frfh-hpr7

OS command injection in Fortinet FortiWLM

Priority MEDIUM 54

A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or comman…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02486 Published 2023-10-10 No fix listed CWE-78
TI-2023-18383 CVE-2023-36548 · GHSA-w468-8qwj-58hh

OS command injection in Fortinet FortiWLM

Priority MEDIUM 54

A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or comman…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02486 Published 2023-10-10 No fix listed CWE-78
TI-2023-18382 CVE-2023-36547 · GHSA-jcw7-8qv8-78px

OS command injection in Fortinet FortiWLM

Priority MEDIUM 54

A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or comman…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02486 Published 2023-10-10 No fix listed CWE-78
TI-2017-04999 CVE-2017-7336 · GHSA-rj7f-vhqh-f6h9

Hard-coded credentials in Fortinet FortiWLM

Priority MEDIUM 54

A hard-coded account named 'upgrade' in Fortinet FortiWLM 8.3.0 and lower versions allows a remote attacker to log-in and execute commands with 'upgrade' account privileges.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02464 Published 2017-07-22 No fix listed CWE-798
TI-2023-18384 CVE-2023-36549 · GHSA-7jff-jj87-9v8m

OS command injection in Fortinet FortiWLM

Priority MEDIUM 48

A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or comman…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02487 Published 2023-10-10 No fix listed CWE-78
TI-2023-26612 CVE-2023-48782 · GHSA-xr3x-xv96-4f83

OS command injection in Fortinet FortiWLM

Priority MEDIUM 45

A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 allows attacker to execute unauthorized code or commands via specifically craf…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02661 Published 2023-12-13 No fix listed CWE-78
TI-2023-17478 CVE-2023-34989 · GHSA-9qw7-mc5m-2r25

OS command injection in Fortinet FortiWLM

Priority MEDIUM 45

A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or comman…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02486 Published 2023-10-10 No fix listed CWE-78
TI-2023-17477 CVE-2023-34988 · GHSA-c78f-mpgq-r5hg

OS command injection in Fortinet FortiWLM

Priority MEDIUM 45

A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or comman…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02486 Published 2023-10-10 No fix listed CWE-78
TI-2023-17476 CVE-2023-34987 · GHSA-qxqx-3rvg-3v54

OS command injection in Fortinet FortiWLM

Priority MEDIUM 45

A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or comman…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02486 Published 2023-10-10 No fix listed CWE-78
TI-2023-17475 CVE-2023-34986 · GHSA-f357-g7p9-rf3h

OS command injection in Fortinet FortiWLM

Priority MEDIUM 45

A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or comman…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02486 Published 2023-10-10 No fix listed CWE-78
TI-2023-17474 CVE-2023-34985 · GHSA-q7gr-xr74-27p6

OS command injection in Fortinet FortiWLM

Priority MEDIUM 45

A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or comman…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02486 Published 2023-10-10 No fix listed CWE-78
TI-2021-14603 CVE-2021-36185 · GHSA-m7vx-ch4r-95hf

OS command injection in Fortinet FortiWLM

Priority MEDIUM 44

A improper neutralization of special elements used in an OS command ('OS Command Injection') in Fortinet FortiWLM version 8.6.1 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01894 Published 2021-11-02 No fix listed CWE-78
TI-2021-19137 CVE-2021-43075 · GHSA-5qrm-3p2g-6c46

OS command injection in Fortinet FortiWLM

Priority MEDIUM 43

A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.2 and below, version 8.5.2 and below, version 8.4.2 and below, version 8.3.2 and below allows…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01623 Published 2022-03-01 No fix listed CWE-78
TI-2021-19139 CVE-2021-43077 · GHSA-wp5x-r5rg-9j9w

SQL injection in Fortinet FortiWLM

Priority MEDIUM 42

A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.2 and below, version 8.5.2 and below, version 8.4.2 and below, version 8.3.2 and below allows attack…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0081 Published 2022-03-01 No fix listed CWE-89
TI-2021-18964 CVE-2021-42760 · GHSA-94p6-v23w-67wg

SQL injection in Fortinet FortiWLM

Priority MEDIUM 42

A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.1 and below allows attacker to disclose sensitive information from DB tables via crafted requests.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0096 Published 2021-12-08 No fix listed CWE-89
TI-2021-14602 CVE-2021-36184 · GHSA-r3xp-qcg2-fr3f

SQL injection in Fortinet FortiWLM

Priority MEDIUM 42

A improper neutralization of Special Elements used in an SQL Command ('SQL Injection') in Fortinet FortiWLM version 8.6.1 and below allows attacker to disclosure device, users and database information via crafted HTTP re…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00999 Published 2021-11-02 No fix listed CWE-89
TI-2023-22874 CVE-2023-42783 · GHSA-4rfh-v443-hvgh

Path traversal in Fortinet FortiWLM

Priority MEDIUM 41

A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 and 8.4.2 through 8.4.0 and 8.3.2 through 8.3.0 and 8.2.2 allows attacker to read arbitrary files via crafted http reques…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00898 Published 2023-11-14 No fix listed CWE-23
TI-2021-19132 CVE-2021-43070 · GHSA-x7gj-6vhf-hvmm

Path traversal in Fortinet FortiWLM

Priority LOW 30

Multiple relative path traversal vulnerabilities [CWE-23] in FortiWLM management interface 8.6.2 and below, 8.5.2 and below, 8.4.2 and below, 8.3.3 and below, 8.2.2 may allow an authenticated attacker to retrieve arbitra…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00556 Published 2022-03-02 No fix listed CWE-22
TI-2021-17893 CVE-2021-41029 · GHSA-3w7f-3j97-hfv4

Cross-site scripting in Fortinet FortiWLM

Priority LOW 29

A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWLM version 8.6.1 and below allows attacker to store malicious javascript code in the device and trigger it via craf…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00532 Published 2021-12-08 No fix listed CWE-79
TI-2021-18956 CVE-2021-42752 · GHSA-jjwg-7f28-x45q

Cross-site scripting in Fortinet FortiWLM

Priority LOW 25

A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWLM version 8.6.1 and below allows attacker to execute malicious javascript code on victim's host via crafted HTTP r…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00532 Published 2021-12-08 No fix listed CWE-79
Open these records in search →