Fortinet
32 CVEs in CISA KEV — 14 with confirmed ransomware use
Products
| CVE | Product | CVSS | EPSS | Added | Due | Flags | Description |
|---|---|---|---|---|---|---|---|
CVE-2022-40684 |
Multiple Products | — | 0.9998 | 2022-10-11 | 2022-11-01 | RW | Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication b |
CVE-2025-25257 |
FortiWeb | — | 0.9992 | 2025-07-18 | 2025-08-08 | Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unaut | |
CVE-2022-42475 |
FortiOS | — | 0.9947 | 2022-12-13 | 2023-01-03 | RW | Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overfl |
CVE-2023-48788 |
FortiClient EMS | — | 0.9845 | 2024-03-25 | 2024-04-15 | RW | Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an u |
CVE-2026-21643 |
FortiClient EMS | — | 0.9774 | 2026-04-13 | 2026-04-16 | Fortinet FortiClient EMS contains a SQL injection vulnerability that may allow a | |
CVE-2024-47575 |
FortiManager | — | 0.9477 | 2024-10-23 | 2024-11-13 | Fortinet FortiManager contains a missing authentication vulnerability in the fgf | |
CVE-2024-55591 |
FortiOS and FortiProxy | — | 0.9435 | 2025-01-14 | 2025-01-21 | RW | Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability t |
CVE-2026-35616 |
FortiClient EMS | — | 0.9398 | 2026-04-06 | 2026-04-09 | Fortinet FortiClient EMS contains an improper access control vulnerability that | |
CVE-2026-39808 |
FortiSandbox | 9.8 | 0.9319 | 2026-07-16 | 2026-07-19 | Fortinet FortiSandbox contains an OS command injection vulnerability that could | |
CVE-2025-64446 |
FortiWeb | — | 0.9108 | 2025-11-14 | 2025-11-21 | Fortinet FortiWeb contains a relative path traversal vulnerability that may allo | |
CVE-2026-24858 |
Multiple Products | — | 0.8659 | 2026-01-27 | 2026-01-30 | Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authent | |
CVE-2023-27997 |
FortiOS and FortiProxy SSL-VPN | — | 0.8569 | 2023-06-13 | 2023-07-04 | RW | Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vul |
CVE-2024-21762 |
FortiOS | 9.8 | 0.8459 | 2024-02-09 | 2024-02-16 | RW | Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remo |
CVE-2026-25089 |
FortiSandbox | — | 0.7611 | 2026-07-16 | 2026-07-19 | Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS c | |
CVE-2025-59718 |
Multiple Products | — | 0.6829 | 2025-12-16 | 2025-12-23 | Fortinet FortiOS, FortiSwitchMaster, FortiProxy, and FortiWeb contain an imprope | |
CVE-2024-23113 |
Multiple Products | — | 0.6172 | 2024-10-09 | 2024-10-30 | Fortinet FortiOS, FortiPAM, FortiProxy, and FortiWeb contain a format string vul | |
CVE-2025-58034 |
FortiWeb | — | 0.5472 | 2025-11-18 | 2025-11-25 | Fortinet FortiWeb contains an OS command Injection vulnerability that may allow | |
CVE-2025-32756 |
Multiple Products | — | 0.3094 | 2025-05-14 | 2025-06-04 | Fortinet FortiFone, FortiVoice, FortiNDR and FortiMail contain a stack-based ove | |
CVE-2025-68686 |
FortiOS | — | 0.2950 | 2026-07-27 | 2026-08-10 | Fortinet FortiOS contains an exposure of sensitive information to an unauthorize | |
CVE-2022-41328 |
FortiOS | — | 0.1068 | 2023-03-14 | 2023-04-04 | Fortinet FortiOS contains a path traversal vulnerability that may allow a local | |
CVE-2025-24472 |
FortiOS and FortiProxy | — | 0.0723 | 2025-03-18 | 2025-04-08 | RW | Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability |
CVE-2026-104286 |
FortiMail | 9.8 | 0.0457 | 2026-10-01 | 2026-10-04 | Fortinet FortiMail contains a path traversal and an improper neutralization of N | |
CVE-2025-25249 |
Multiple Products | — | 0.0374 | 2026-09-09 | 2026-09-12 | Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer | |
CVE-2025-61624 |
Multiple Products | — | 0.0134 | 2026-10-16 | 2026-10-19 | FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal v | |
CVE-2019-6693 |
FortiOS | — | — | 2025-06-25 | 2025-07-16 | RW | Fortinet FortiOS contains a use of hard-coded credentials vulnerability that cou |
CVE-2018-13374 |
FortiOS and FortiADC | — | — | 2022-09-08 | 2022-09-29 | RW | Fortinet FortiOS and FortiADC contain an improper access control vulnerability t |
CVE-2018-13382 |
FortiOS and FortiProxy | — | — | 2022-01-10 | 2022-07-10 | RW | An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under |
CVE-2018-13383 |
FortiOS and FortiProxy | — | — | 2022-01-10 | 2022-07-10 | RW | A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN |
CVE-2021-44168 |
FortiOS | — | — | 2021-12-10 | 2021-12-24 | Fortinet FortiOS "execute restore src-vis" downloads code without integrity chec | |
CVE-2019-5591 |
FortiOS | — | — | 2021-11-03 | 2022-05-03 | RW | Fortinet FortiOS contains a default configuration vulnerability that may allow a |
CVE-2020-12812 |
FortiOS | — | — | 2021-11-03 | 2022-05-03 | RW | Fortinet FortiOS SSL VPN contains an improper authentication vulnerability that |
CVE-2018-13379 |
FortiOS | — | — | 2021-11-03 | 2022-05-03 | RW | Fortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that |