Skip to content
Noroxi

Fortinet records

1,143 published records for vendor fortinet.

Researcher profile

Entered KEV
31 · 2.7%
Weaponized
34 · 3%
Pre-auth RCE
45
With a fix record
1%
Median publish → KEV
7 days

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25
  10. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

1,143 records
  • CVE-2018-13379
    99Now

    An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    fortinet · fortiproxyJun 4, 2019

  • CVE-2022-40684
    99Now

    An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    fortinet · fortiproxyOct 18, 2022

  • CVE-2025-25257
    99Now

    An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet For

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    fortinet · fortiwebJul 17, 2025

  • CVE-2022-42475
    99Now

    A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    fortinet · fortiosJan 2, 2023

  • CVE-2023-48788
    99Now

    A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.

    CriticalCVSS 9.8KEVWeaponizedEPSS 98%

    fortinet · forticlient enterprise management serverMar 12, 2024

  • CVE-2024-47575
    97Now

    A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, Fo

    CriticalCVSS 9.8KEVWeaponizedEPSS 95%

    fortinet · fortimanagerOct 23, 2024

  • CVE-2024-55591
    97Now

    An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and Forti

    CriticalCVSS 9.8KEVWeaponizedEPSS 94%

    fortinet · fortiproxyJan 14, 2025

  • CVE-2026-21643
    97Now

    An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may a

    CriticalCVSS 9.8KEVWeaponizedEPSS 94%

    fortinet · forticlientemsFeb 6, 2026

  • CVE-2025-64446
    97Now

    A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9

    CriticalCVSS 9.8KEVWeaponizedEPSS 92%

    fortinet · fortiwebNov 14, 2025

  • CVE-2026-24858
    95Now

    An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.

    CriticalCVSS 9.8KEVWeaponizedEPSS 86%

    fortinet · fortianalyzerJan 27, 2026

  • CVE-2023-27997
    95Now

    A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below,

    CriticalCVSS 9.8KEVWeaponizedEPSS 86%

    fortinet · fortiproxyJun 13, 2023

  • CVE-2024-21762
    94Now

    A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2

    CriticalCVSS 9.8KEVWeaponizedEPSS 83%

    fortinet · fortiproxyFeb 9, 2024

  • CVE-2026-25089
    92Now

    A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 th

    CriticalCVSS 9.8KEVWeaponizedEPSS 76%

    fortinet · fortisandboxJun 9, 2026

  • CVE-2025-59718
    89Now

    A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, Forti

    CriticalCVSS 9.8KEVWeaponizedEPSS 68%

    fortinet · fortiproxyDec 9, 2025

  • CVE-2024-23113
    88Now

    A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, Fo

    CriticalCVSS 9.8KEVWeaponizedEPSS 62%

    fortinet · fortiproxyFeb 15, 2024

  • CVE-2018-13382
    85Now

    An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 t

    HighCVSS 7.5KEVWeaponizedEPSS 82%

    fortinet · fortiproxyJun 4, 2019

  • CVE-2026-39808
    83Now

    A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 th

    CriticalCVSS 9.8KEVWeaponizedEPSS 47%

    fortinet · fortisandboxApr 14, 2026

  • CVE-2020-12812
    83Now

    An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log

    CriticalCVSS 9.8KEVWeaponizedEPSS 45%

    fortinet · fortiosJul 24, 2020

  • CVE-2025-32756
    78This week

    A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all version

    CriticalCVSS 9.8KEVWeaponizedEPSS 31%

    fortinet · fortimailMay 13, 2025

  • CVE-2025-58034
    75This week

    An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortin

    HighCVSS 7.2KEVWeaponizedEPSS 56%

    fortinet · fortiwebNov 18, 2025

  • CVE-2026-35616
    72This week

    A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unau

    CriticalCVSS 9.8KEVWeaponizedEPSS 9%

    fortinet · forticlientemsApr 3, 2026

  • CVE-2025-25249
    70This week

    A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.1

    CriticalCVSS 9.8KEVWeaponizedEPSS 4%

    fortinet · fortiosJan 13, 2026

  • CVE-2026-104286
    70This week

    An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, F

    CriticalCVSS 9.8KEVWeaponizedEPSS 2%

    fortinet · fortimailOct 1, 2026

  • CVE-2022-39952
    69This week

    A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11,

    CriticalCVSS 9.8WeaponizedEPSS 100%

    fortinet · fortinacFeb 16, 2023

  • CVE-2018-13383
    66This week

    A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProx

    MediumCVSS 6.5KEVWeaponizedEPSS 34%

    fortinet · fortiproxyMay 29, 2019