Fortinet known exploited vulnerabilities
Every Fortinet CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 32 in all, 12 added in the last 12 months.
- CVE-2019-6693Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to theFortinet FortiGate
- CVE-2025-24472An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.Fortinet FortiOS · Fortinet FortiProxy
- CVE-2024-55591An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiFortinet FortiOS · Fortinet FortiProxy
- CVE-2023-48788A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.Fortinet FortiClientEMS
- CVE-2024-21762A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.13, FortFortinet FortiOS · Fortinet FortiProxy
- CVE-2023-27997A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below,Fortinet FortiOS-6K7K · Fortinet FortiProxy +1
- CVE-2022-42475A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.Fortinet FortiProxy · Fortinet FortiOS
- CVE-2022-40684An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.Fortinet FortiOS, FortiProxy, FortiSwitchManager
- CVE-2018-13374A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtFortinet FortiOS, fortiADC
- CVE-2018-13383A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxFortinet FortiOS and FortiProxy
- CVE-2018-13382An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 tFortinet FortiOS, FortiProxy
- CVE-2020-12812An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to logFortinet FortiOS
- CVE-2019-5591A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive informationFortinet FortiOS
- CVE-2018-13379An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4Fortinet FortiOS, FortiProxy
FAQ
Fortinet KEV questions.
How many Fortinet vulnerabilities are in CISA KEV?
32 Fortinet vulnerabilities are on CISA's Known Exploited Vulnerabilities catalog, 12 of them added in the last 12 months. The newest is CVE-2025-61624 (Fortinet Multiple Products Path Traversal Vulnerability), added 2026-10-16.
Which Fortinet products are in CISA KEV?
10 products, including Multiple Products, FortiMail, FortiOS. Attackers have exploited every one of these entries in the wild, and US federal agencies must patch each by its CISA due date.
Are Fortinet KEV vulnerabilities used by ransomware?
CISA knows ransomware campaigns exploit 14 of the 32 Fortinet entries.