Fortinet vulnerabilities
The newest vulnerabilities affecting Fortinet, up to 200. Subscribe by RSS.
- CVE-2026-106174A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network aFortinet FortiOS
- CVE-2026-107656An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 tFortinet FortiSandbox
- CVE-2026-106175A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.8, FortiOS 7.4 all versions, FortiOS 7.2 all versiFortinet FortiOS · Fortinet FortiSwitch +1
- CVE-2026-106172A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSanFortinet FortiSandbox
- CVE-2026-23707An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet ForFortinet FortiManager Cloud · Fortinet FortiAnalyzer Clo… +2
- CVE-2026-23706An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet ForFortinet FortiAnalyzer Cloud · Fortinet FortiAnalyzer +1
- CVE-2026-23705An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet ForFortinet FortiAnalyzer · Fortinet FortiManager
- CVE-2025-46773An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet ForFortinet FortiAnalyzer Cloud · Fortinet FortiAnalyzer
- CVE-2025-57739An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet ForFortinet FortiMail
- CVE-2026-106170An Uncaught Exception vulnerability [CWE-248] vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, Fortinet FortiSandbox
- CVE-2026-106173A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attackeFortinet FortiSIEM
- CVE-2026-106176A missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via Specially Fortinet FortiSIEM
- CVE-2026-106171A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiManager 8.0.0, FFortinet FortiManager
- CVE-2026-104286An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FFortinet FortiMail
- CVE-2026-84388A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions, FortiPAM ChromeFortinet FortiPAM Chrome Extension
- CVE-2026-84390A inclusion of sensitive information in source code vulnerability in Fortinet FortiMonitorOnSight 7.2.4 through 7.2.7, FortiMonitorOnSight 7Fortinet FortiMonitorOnSight
- CVE-2026-84392A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0Fortinet FortiOS · Fortinet FortiProxy +1
- CVE-2026-22575An improper access control vulnerability in Fortinet FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.10, FortiManager 7.2 aFortinet FortiManager
- CVE-2026-84391A use of uninitialized variable vulnerability in Fortinet FortiAnalyzer 7.6.3 through 7.6.6 may allow attacker to denial of service via <insFortinet FortiAnalyzer
- CVE-2026-84393A improper validation of certificate with host mismatch vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6, FortiProxy 7.6.2 through 7.6.Fortinet FortiOS · Fortinet FortiProxy
- CVE-2026-26084A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5Fortinet FortiSandbox PaaS · Fortinet FortiSandbox
- CVE-2026-84385A improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.6, FortiSOAR PaaS 7.5.0 through 7.5.3, FortiSOAR PaaS 7Fortinet FortiSOAR on-premise · Fortinet FortiSOAR PaaS
- CVE-2026-84389A url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiSIEM 7.5.0 through 7.5.1, FortiSIEM 7.4.1 through 7.4.2Fortinet FortiSIEM
- CVE-2026-84387An Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability [CWE-77] vulnerability in Fortinet FortFortinet FortiSandbox
- CVE-2026-84386A unverified ownership vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2 all versions may allow attacFortinet FortiClientWindows
- CVE-2026-70468A authentication bypass using an alternate path or channel vulnerability in Fortinet FortiManager 7.6.1, FortiManager 7.4.3 through 7.4.5, FFortinet FortiManager
- CVE-2026-26035An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, ForFortinet FortiWeb
- CVE-2026-70466A incomplete list of disallowed inputs vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4 alFortinet FortiWeb · Fortinet FortiOS
- CVE-2026-71407A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6 may allow an unauthenticated attFortinet FortiOS · Fortinet FortiPAM +1
- CVE-2026-70467A server-side request forgery (ssrf) vulnerability in Fortinet FortiSIEM 7.5.0, FortiSIEM 7.4.0 through 7.4.2, FortiSIEM 7.3.0 through 7.3.5Fortinet FortiSIEM
- CVE-2026-71408A allocation of resources without limits or throttling vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4 all versions, FortFortinet FortiOS
- CVE-2026-70465A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FFortinet FortiClientWindows
- CVE-2026-59838A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 tFortinet FortiSIEM
- CVE-2026-59840A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0Fortinet FortiOS · Fortinet FortiPAM +2
- CVE-2025-43892A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0Fortinet FortiOS
- CVE-2026-23573An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet ForFortinet FortiOS · Fortinet FortiProxy +1
- CVE-2026-59839A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortFortinet FortiProxy · Fortinet FortiOS +1
- CVE-2025-62826An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet FFortinet FortiPAM · Fortinet FortiProxy +1
- CVE-2025-62675An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet FFortinet FortiOS · Fortinet FortiPAM +1
- CVE-2026-59836A improper certificate validation vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.5, FortiClientEMS 7.4.0 through 7.4.1, FortiCliFortinet FortiClientEMS
- CVE-2026-59841A improper restriction of communication channel to intended endpoints vulnerability in Fortinet FortiSIEMWindowsAgent 7.4.0 through 7.4.1 maFortinet FortiSIEMWindowsAgent
- CVE-2025-53379A out-of-bounds read vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.2, FortiAuthenticator 6.5 all versions may allow a remotFortinet FortiAuthenticator
- CVE-2026-59835A exposure of resource to wrong sphere vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.3 through 4.4.8 may alloFortinet FortiSandbox
- CVE-2026-59837A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2 all versions, FortiOS 7.0 all versions, ForFortinet FortiOS · Fortinet FortiProxy +1
- CVE-2025-67862An Internal Asset Exposed to Unsafe Debug Access Level or State vulnerability [CWE-1244] vulnerability in Fortinet FortiOS 7.6.0 through 7.6Fortinet FortiOS · Fortinet FortiProxy
- CVE-2026-25089A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 thFortinet FortiSandbox
- CVE-2026-49938A improper access control vulnerability in Fortinet FortiPortal 7.4.0 through 7.4.7, FortiPortal 7.2.0 through 7.2.8, FortiPortal 7.0 all veFortinet FortiPortal
- CVE-2025-53870An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAP 7.6.0 througFortinet FortiAP · Fortinet FortiAP-W2
- CVE-2025-53680An improper neutralization of special elements used in an OS command ("OS Command Injection") vulnerability [CWE-78] vulnerability in FortinFortinet FortiAP-U · Fortinet FortiAP-W2 +1
- CVE-2025-67604A use of potentially dangerous function vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.8, FortFortinet FortiAnalyzer · Fortinet FortiManager
- CVE-2025-53681An improper neutralization of special elements used in an SQL Command ("SQL Injection&") vulnerability [CWE-89] vulnerability in Fortinet FoFortinet FortiMail
- CVE-2026-25690An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor 6.0.0 through Fortinet FortiDeceptor
- CVE-2025-53844A out-of-bounds write vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11 allowFortinet FortiOS
- CVE-2026-44279An improper export of android application components vulnerability in Fortinet FortiTokenAndroid 6.2 all versions, FortiTokenAndroid 6.1 allFortinet FortiTokenAndroid
- CVE-2026-44278A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.2, FortiClientWindows 7.2 all versions Fortinet FortiClientWindows
- CVE-2026-25088An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiNDR 7.6.0 through 7.6Fortinet FortiNDR
- CVE-2026-44277A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6Fortinet FortiAuthenticator
- CVE-2026-26083A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0Fortinet FortiSandbox
- CVE-2026-40688An out-of-bounds write vulnerability [CWE-787] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeFortinet FortiWeb
- CVE-2025-61624An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7Fortinet FortiOS · Fortinet FortiProxy +2
- CVE-2025-68649An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.Fortinet FortiManager Cloud · Fortinet FortiManager +1
- CVE-2026-21741An URL Redirection to Untrusted Site ('Open Redirect') vulnerability [CWE-601] vulnerability in Fortinet FortiNAC-F 7.6.0 through 7.6.5, ForFortinet FortiNAC-F
- CVE-2026-39813A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8 may allow attackFortinet FortiSandbox
- CVE-2025-61848An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 7.6.0 througFortinet FortiManager · Fortinet FortiAnalyzer +1
- CVE-2026-22828A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiManager Cloud 7.6.2 through 7.6.4 may aFortinet FortiAnalyzer Cloud · Fortinet FortiManager Cloud
- CVE-2026-39815A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiDDoS-F 7.2.1 through 7Fortinet FortiDDoS-F
- CVE-2026-22573An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6Fortinet FortiSOAR on-premise · Fortinet FortiSOAR PaaS
- CVE-2025-61886An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet ForFortinet FortiSandbox PaaS · Fortinet FortiSandbox
- CVE-2026-39810A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientEMS 7.4.0 through 7.4.5 may allow attacker to information disclosFortinet FortiClientEMS
- CVE-2026-39811A integer overflow or wraparound vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4 all versFortinet FortiWeb
- CVE-2024-23104An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.8, FortiNFortinet FortiVoice · Fortinet FortiNDR
- CVE-2026-39812A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 5.0.0 through Fortinet FortiSandbox
- CVE-2026-23708A improper authentication vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR on-preFortinet FortiSOAR PaaS · Fortinet FortiSOAR on-premise
- CVE-2026-39814Multiple Relative Path Traversal vulnerabilities [CWE-23] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6Fortinet FortiWeb
- CVE-2026-25691A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5,Fortinet FortiSandbox PaaS · Fortinet FortiSandbox Cloud +1
- CVE-2025-59809A server-side request forgery (ssrf) vulnerability [CWE-918] vulnerability in Fortinet FortiSOAR PaaS 7.6.4, FortiSOAR PaaS 7.6.0 through 7.Fortinet FortiSOAR on-premise · Fortinet FortiSOAR PaaS
- CVE-2026-22155A cleartext transmission of sensitive information vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 throughFortinet FortiSOAR PaaS · Fortinet FortiSOAR on-premise
- CVE-2026-21742A cleartext transmission of sensitive information vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 throughFortinet FortiSOAR on-premise · Fortinet FortiSOAR PaaS
- CVE-2026-22574A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2Fortinet FortiSOAR PaaS · Fortinet FortiSOAR on-premise
- CVE-2026-22154An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSOAR PaaS 7.6.0 throuFortinet FortiSOAR PaaS · Fortinet FortiSOAR on-premise
- CVE-2025-53847A missing authentication for critical function vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7Fortinet FortiOS
- CVE-2026-22576A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2Fortinet FortiSOAR PaaS · Fortinet FortiSOAR on-premise
- CVE-2026-27316A insufficiently protected credentials vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4 all versions, FortiSandbFortinet FortiSandbox
- CVE-2026-39808A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 thFortinet FortiSandbox
- CVE-2026-39809A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.0 througFortinet FortiClientEMS
- CVE-2026-35616A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauFortinet FortiClientEMS
- CVE-2025-66178A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiWeb 8.0.0 througFortinet FortiWeb
- CVE-2026-24641A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, ForFortinet FortiWeb
- CVE-2026-24640A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, Fortinet FortiWeb
- CVE-2025-54659An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] vulnerability in Fortinet FortiSOARFortinet FortiSOAR Agent Communication Bridge
- CVE-2026-24017An Improper Control of Interaction Frequency vulnerability [CWE-799] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 Fortinet FortiWeb
- CVE-2026-25972An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEMFortinet FortiSIEM
- CVE-2026-22629An improper restriction of excessive authentication attempts vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4 Fortinet FortiAnalyzer · Fortinet FortiManager Cloud +1
- CVE-2025-68482A improper certificate validation vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.8, FortiAnalyFortinet FortiAnalyzer · Fortinet FortiManager
- CVE-2025-48418A hidden functionality vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.3, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2.0 tFortinet FortiAnalyzer · Fortinet FortiManager
- CVE-2025-49784An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 7.6.0 througFortinet FortiAnalyzer-BigData · Fortinet FortiAnalyzer
- CVE-2026-22572An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.3, FortiAnalyzer 7.4.0Fortinet FortiManager · Fortinet FortiAnalyzer
- CVE-2025-68648A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7,Fortinet FortiManager Cloud · Fortinet FortiAnalyzer Clo… +2
- CVE-2026-25689An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor 6.2.0, FortiDeFortinet FortiDeceptor
- CVE-2025-53608An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet ForFortinet FortiSandbox
- CVE-2026-24018A UNIX symbolic link (Symlink) following vulnerability in Fortinet FortiClientLinux 7.4.0 through 7.4.4, FortiClientLinux 7.2.2 through 7.2.Fortinet FortiClientLinux
- CVE-2025-48840An authentication bypass by spoofing vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.8, FortiWeb 7.2 all Fortinet FortiWeb
- CVE-2026-22627A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiSwitchAXFixed 1.0.0 through 1.0.1 maFortinet FortiSwitchAXFixed
- CVE-2025-54820A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiManager 7.4.0 through 7.4.2, FortiManager 7.2.0 throughFortinet FortiManager
- CVE-2025-55717A cleartext storage of sensitive information vulnerability [CWE-312] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.Fortinet FortiVoice · Fortinet FortiMail +1
- CVE-2026-25836An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox Cloud 5Fortinet FortiSandbox Cloud · Fortinet FortiSandbox PaaS
- CVE-2026-30897A stack-based buffer overflow vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7Fortinet FortiWeb
- CVE-2026-22628An improper access control vulnerability in Fortinet FortiSwitchAXFixed 1.0.0 through 1.0.1 may allow an authenticated admin to execute systFortinet FortiSwitchAXFixed
- CVE-2025-62439An Improper Verification of Source of a Communication Channel vulnerability [CWE-940] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4,Fortinet FortiOS
- CVE-2025-62676An Improper Link Resolution Before File Access ('Link Following') vulnerability [CWE-59] vulnerability in Fortinet FortiClientWindows 7.4.0 Fortinet FortiClientWindows
- CVE-2025-68686An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1,Fortinet FortiOS
- CVE-2025-64157A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2Fortinet FortiOS
- CVE-2025-55018An inconsistent interpretation of http requests ('http request smuggling') vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.Fortinet FortiOS
- CVE-2026-22153An Authentication Bypass by Primary Weakness vulnerability [CWE-305] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4 may allow an unauFortinet FortiOS
- CVE-2026-21743A missing authorization vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthentiFortinet FortiAuthenticator
- CVE-2025-52436An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet ForFortinet FortiSandbox
- CVE-2026-21643An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may aFortinet FortiClientEMS
- CVE-2026-25815Fortinet FortiOS through 7.6.6 allows attackers to decrypt LDAP credentials stored in device configuration files, as exploited in the wild fFortinet FortiOS
- CVE-2026-24858An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.Fortinet FortiWeb · Fortinet FortiNAC-F +4
- CVE-2025-25249A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.1Fortinet FortiSwitchManager · Fortinet FortiOS
- CVE-2025-47855An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in Fortinet FortiFone 7.0.0 through 7.0.1, FortiFone 3Fortinet FortiFone
- CVE-2025-67685A Server-Side Request Forgery (SSRF) vulnerability [CWE-918] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.4, FortiSandbox 4.4 alFortinet FortiSandbox
- CVE-2025-58693An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, Fortinet FortiVoice
- CVE-2025-59922An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet ForFortinet FortiClientEMS
- CVE-2025-64155An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSIEM 7.4.0, ForFortinet FortiSIEM
- CVE-2024-40593A key management errors vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.2, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzer 7.0 alFortinet FortiAnalyzer · Fortinet FortiPortal +2
- CVE-2024-47570An insertion of sensitive information into log file vulnerability [CWE-532] in FortiOS 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0 all verFortinet FortiSASE · Fortinet FortiProxy +3
- CVE-2025-59718A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiFortinet FortiSwitchManager · Fortinet FortiOS +1
- CVE-2025-59719An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 tFortinet FortiWeb
- CVE-2025-53679An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in FortinFortinet FortiSandbox
- CVE-2025-54353An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet ForFortinet FortiSandbox
- CVE-2025-53949An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in FortinFortinet FortiSandbox
- CVE-2025-59810An improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.2, FortiSOAR PaaS 7.5.0 through 7.5.1, FortiSOAR PaaS Fortinet FortiSOAR on-premise · Fortinet FortiSOAR PaaS
- CVE-2025-59808An unverified password change vulnerability [CWE-620] vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.2, FortiSOAR PaaS 7.5.0 thrFortinet FortiSOAR on-premise · Fortinet FortiSOAR PaaS
- CVE-2025-54838An Incorrect Authorization vulnerability [CWE-863] in FortiPortal 7.4.0 through 7.4.5 may allow an authenticated attacker to reboot a sharedFortinet FortiPortal
- CVE-2025-62631An insufficient session expiration vulnerability [CWE-613] vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2 all versions, FortiOS 7.0 alFortinet FortiOS
- CVE-2025-57823A direct request ('forced browsing') vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, Fortinet FortiAuthenticator
- CVE-2025-64153A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7.6.0 through 7.6.3, Fortinet FortiExtender
- CVE-2025-59923An improper access control vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAutheFortinet FortiAuthenticator
- CVE-2025-64156An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiVoice 7.2.0 through 7Fortinet FortiVoice
- CVE-2025-64471A use of password hash instead of password for authentication vulnerability [CWE-836] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1Fortinet FortiWeb
- CVE-2025-60024Multiple Improper Limitations of a Pathname to a Restricted Directory ('Path Traversal') vulnerabilities [CWE-22] vulnerability in Fortinet Fortinet FortiVoice
- CVE-2025-64447A reliance on cookies without validation and integrity checking vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 throuFortinet FortiWeb
- CVE-2025-58412A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiADC 8.0.0, FortiADC 7.6.0 thrFortinet FortiADC
- CVE-2025-53843A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, Fortinet FortiOS
- CVE-2025-48839An Out-of-bounds Write vulnerability [CWE-787] in FortiADC 8.0.0, 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, 7.2 all versions, 7.1 all versioFortinet FortiADC
- CVE-2025-54821An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.11Fortinet FortiOS · Fortinet FortiProxy +1
- CVE-2025-58413A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, Fortinet FortiOS · Fortinet FortiSASE
- CVE-2025-46215An Improper Isolation or Compartmentalization vulnerability [CWE-653] in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 throuFortinet FortiSandbox
- CVE-2025-59669A use of hard-coded credentials vulnerability in Fortinet FortiWeb 7.6.0, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0Fortinet FortiWeb
- CVE-2025-54660An active debug code vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through 7.2.10, FortiClientWFortinet FortiClientWindows
- CVE-2025-61713A Cleartext Storage of Sensitive Information in Memory vulnerability [CWE-316] in Fortinet FortiPAM 1.6.0, FortiPAM 1.5 all versions, FortiPFortinet FortiPAM
- CVE-2025-46776A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiExtender 7.6.0 through 7.6.1, FortiEFortinet FortiExtender
- CVE-2025-46775A debug messages revealing unnecessary information vulnerability in Fortinet FortiExtender 7.6.0 through 7.6.1, FortiExtender 7.4.0 through Fortinet FortiExtender
- CVE-2025-54971An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiADC 7.4.0, FortiADC 7.2 all versions, FortiADC Fortinet FortiADC
- CVE-2025-54972An improper neutralization of crlf sequences ('crlf injection') vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 thrFortinet FortiMail
- CVE-2025-46373A Heap-based Buffer Overflow vulnerability [CWE-122] vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.Fortinet FortiClientWindows
- CVE-2025-58692An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet ForFortinet FortiVoice
- CVE-2025-58034An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in FortinFortinet FortiWeb
- CVE-2025-47761An Exposed IOCTL with Insufficient Access Control vulnerability [CWE-782] vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, Fortinet FortiClientWindows
- CVE-2025-64446A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9Fortinet FortiWeb
- CVE-2025-46752A insertion of sensitive information into log file in Fortinet FortiDLP 12.0.0 through 12.0.5, 11.5.1, 11.4.6, 11.4.5 allows attacker to infFortinet FortiDLP
- CVE-2025-53950An Exposure of Private Personal Information ('Privacy Violation') vulnerability [CWE-359] in Fortinet FortiDLP Agent's Outlookproxy plugin fFortinet FortiDLP
- CVE-2025-53951An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiDLP Agent's OutlooFortinet FortiDLP
- CVE-2025-54658An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiDLP Agent's OutlooFortinet FortiDLP
- CVE-2025-31514A insertion of sensitive information into log file vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4 all versions, FortiOS Fortinet FortiOS · Fortinet FortiProxy
- CVE-2025-46774An Improper Verification of Cryptographic Signature vulnerability [CWE-347] in FortiClient MacOS installer version 7.4.2 and below, version Fortinet FortiClientMac
- CVE-2025-54822An improper authorization vulnerability [CWE-285] vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.8, FortiOFortinet FortiProxy · Fortinet FortiOS
- CVE-2025-31365An Improper Control of Generation of Code ('Code Injection') vulnerability [CWE-94] in FortiClientMac 7.4.0 through 7.4.3, 7.2.1 through 7.2Fortinet FortiClientMac
- CVE-2025-53845An improper authentication vulnerability [CWE-287] in Fortinet FortiAnalyzer version 7.6.0 through 7.6.3 and before 7.4.6 allows an unauthenFortinet FortiAnalyzer
- CVE-2025-59921An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in Fortinet FortiADC version 7.4.0, version 7.2.3 and Fortinet FortiADC
- CVE-2024-33507An insufficient session expiration vulnerability [CWE-613] and an incorrect authorization vulnerability [CWE-863] in FortiIsolator 2.4.0 thrFortinet FortiIsolator
- CVE-2025-57716An Uncontrolled Search Path Element vulnerability [CWE-427] in FortiClient Windows 7.4.0 through 7.4.3, 7.2.0 through 7.2.11, 7.0 all versioFortinet FortiClientWindows
- CVE-2025-25255An Improperly Implemented Security Check for Standard vulnerability [CWE-358] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiPrFortinet FortiOS · Fortinet FortiProxy
- CVE-2025-25252An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10Fortinet FortiOS
- CVE-2024-26008An improper check or handling of exceptional conditions vulnerability [CWE-703] in FortiOS version 7.4.0 through 7.4.3 and before 7.2.7, ForFortinet FortiProxy · Fortinet FortiPAM +2
- CVE-2024-47569A insertion of sensitive information into sent data vulnerability in Fortinet FortiMail 7.4.0 through 7.4.2, FortiMail 7.2.0 through 7.2.6, Fortinet FortiManager · Fortinet FortiOS +8
- CVE-2025-54973A concurrent execution using shared resource with improper synchronization ('Race Condition') vulnerability [CWE-362] in Fortinet FortiAnalyFortinet FortiAnalyzer
- CVE-2023-46718A stack-based buffer overflow in Fortinet FortiOS version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.7 and 7.0.0 through 7.0.12 and 6.4.6 thrFortinet FortiOS · Fortinet FortiProxy
- CVE-2024-50571A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.0 through 7.4.5, FortiAnalyzer 7Fortinet FortiManager · Fortinet FortiOS +2
- CVE-2025-31366An Improper Neutralization of Input During Web Page Generation vulnerability [CWE-79] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3,Fortinet FortiSASE · Fortinet FortiOS +1
- CVE-2025-22258A heap-based buffer overflow in Fortinet FortiSRA 1.5.0, 1.4.0 through 1.4.2, FortiPAM 1.5.0, 1.4.0 through 1.4.2, 1.3.0 through 1.3.1, 1.2.Fortinet FortiPAM · Fortinet FortiOS +3
- CVE-2025-25253An Improper Validation of Certificate with Host Mismatch vulnerability [CWE-297] in FortiProxy version 7.6.1 and below, version 7.4.8 and beFortinet FortiProxy · Fortinet FortiOS +1
- CVE-2025-57740An Heap-based Buffer Overflow vulnerability [CWE-122] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below,Fortinet FortiPAM · Fortinet FortiProxy +1
- CVE-2025-47890An URL Redirection to Untrusted Site vulnerabilities [CWE-601] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through Fortinet FortiOS · Fortinet FortiProxy +1
- CVE-2025-57741An Incorrect Permission Assignment for Critical Resource vulnerability [CWE-732] in FortiClientMac 7.4.0 through 7.4.3, 7.2.0 through 7.2.11Fortinet FortiClientMac
- CVE-2025-49201A weak authentication vulnerability in Fortinet FortiPAM 1.5.0, FortiPAM 1.4.0 through 1.4.2, FortiPAM 1.3 all versions, FortiPAM 1.2 all veFortinet FortiPAM · Fortinet FortiSwitchManager
- CVE-2025-58325An Incorrect Provision of Specified Functionality vulnerability [CWE-684] in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2.5 through 7.2.10, 7.0.0Fortinet FortiOS
- CVE-2025-58324An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiSIEM 7.2.0 through 7.2.2, 7.1 all versions, 7.Fortinet FortiSIEM
- CVE-2025-58903An Unchecked Return Value vulnerability [CWE-252] in Fortinet FortiOS version 7.6.0 through 7.6.3 and before 7.4.8 API allows an authenticatFortinet FortiOS
- CVE-2024-48891An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiSOAR 7.6.0 throFortinet FortiSOAR on-premise
- CVE-2025-47856Two improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilities [CWE-78] in Fortinet FortiVoiFortinet FortiVoice
- CVE-2025-22862An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiOS 7.4.0 through 7.4.7, 7.2.0 through 7.2.11, 7.Fortinet FortiProxy · Fortinet FortiOS
- CVE-2024-45325An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilities [CWE-78] in Fortinet FortiDDoSFortinet FortiDDoS-F
- CVE-2025-53609A Relative Path Traversal vulnerability [CWE-23] in FortiWeb 7.6.0 through 7.6.4, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11, 7.0.2 through 7Fortinet FortiWeb
- CVE-2024-48892A relative path traversal vulnerability [CWE-23] in FortiSOAR 7.6.0, 7.5.0 through 7.5.1, 7.4 all versions, 7.3 all versions may allow an auFortinet FortiSOAR
- CVE-2024-48884A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiManager 7.6.0 through 7.6.1,Fortinet FortiOS · Fortinet FortiProxy +1
- CVE-2023-36640A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions,Fortinet FortiOS · Fortinet FortiPAM +1
- CVE-2023-45583A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions,Fortinet FortiOS · Fortinet FortiProxy +2
- CVE-2023-29178A access of uninitialized pointer vulnerability [CWE-824] vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4, FortiOS 7.0.0 through 7.0.1Fortinet FortiOS · Fortinet FortiProxy