Browse CVEs

CRITICAL 9.8 CVE-2026-25089 KEVEPSS 74% A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0… Fortisandbox 4.4.9 / 5.0.6+ Fix from $2,3002026-06-09 CRITICAL 9.8 CVE-2026-39808 KEVEPSS 91% A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4… Fortisandbox after 4.4.9 Fix from $2,3002026-04-14 CRITICAL 9.8 CVE-2026-35616 KEVEPSS 91% A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized … Forticlientems Patch available Fix from $2,3002026-04-04 MEDIUM 5.9 CVE-2025-68686 KEV An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS … Fortios 7.4.7 / 7.6.2+ Fix from $1,6002026-02-10 CRITICAL 9.8 CVE-2026-21643 KEVEPSS 94% An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an u… Forticlientems Mitigation only Fix from $2,3002026-02-06 CRITICAL 9.8 CVE-2026-24858 KEVEPSS 86% An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, Fort… Fortianalyzer 7.4.10 / 7.4.11+ Fix from $2,3002026-01-27 CRITICAL 9.8 CVE-2025-59718 KEVEPSS 63% A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 … Fortiproxy 7.0.6 / 7.0.18+ Fix from $2,3002025-12-09 HIGH 7.2 CVE-2025-58034 KEVEPSS 56% An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiW… Fortiweb 7.0.12 / 7.2.12+ Fix from $1,9502025-11-18 CRITICAL 9.8 CVE-2025-64446 KEVEPSS 92% A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWe… Fortiweb 7.0.12 / 7.2.12+ Fix from $2,3002025-11-14 CRITICAL 9.8 CVE-2025-25257 KEVEPSS 100% An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6… Fortiweb 7.0.11 / 7.2.11+ Fix from $2,3002025-07-17 CRITICAL 9.8 CVE-2025-32756 KEVEPSS 30% A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions, FortiC… Fortimail 6.4.6 / 6.4.11+ Fix from $2,3002025-05-13 HIGH 8.1 CVE-2025-24472 KEV An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 throu… Fortiproxy 7.0.17 / 7.0.20+ Fix from $1,9502025-02-11 CRITICAL 9.8 CVE-2024-55591 KEVEPSS 98% An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy ver… Fortiproxy 7.0.17 / 7.0.20+ Fix from $2,3002025-01-14 CRITICAL 9.8 CVE-2024-47575 KEVEPSS 95% A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManage… Fortimanager 6.2.13 / 6.4.15+ Fix from $2,3002024-10-23 CRITICAL 9.8 CVE-2023-48788 KEVEPSS 98% A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiC… Forticlient Enterprise Management Server 7.0.11 / 7.2.3+ Fix from $2,3002024-03-12 CRITICAL 9.8 CVE-2024-23113 KEVEPSS 62% A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy … Fortiproxy after 7.4.2 Fix from $2,3002024-02-15 CRITICAL 9.8 CVE-2024-21762 KEVEPSS 84% A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 throug… Fortiproxy 2.0.14 / 6.0.18+ Fix from $2,3002024-02-09 CRITICAL 9.8 CVE-2023-27997 KEVEPSS 86% A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version … Fortiproxy after 7.2.4 Fix from $2,3002023-06-13 HIGH 7.1 CVE-2022-41328 KEVEPSS 12% A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 through 7.2… Fortios 6.2.14 / 6.4.12+ Fix from $1,9502023-03-07 CRITICAL 9.8 CVE-2022-42475 KEVEPSS 99% A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through… Fortios 2.0.12 / 6.0.15+ Fix from $2,3002023-01-02 CRITICAL 9.8 CVE-2022-40684 KEVEPSS 100% An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiP… Fortiproxy 7.0.7 / 7.2.2+ Fix from $2,3002022-10-18 HIGH 7.8 CVE-2021-44168 KEV A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authentic… Fortios 6.0.14 / 6.2.10+ Fix from $1,9502022-01-04 MEDIUM 6.5 CVE-2019-5591 KEVEPSS 18% A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by imper… Fortios after 6.2.0 Fix from $1,6002020-08-14 CRITICAL 9.8 CVE-2020-12812 KEVEPSS 49% An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in succe… Fortios 6.0.10 / 6.2.4+ Fix from $2,3002020-07-24 MEDIUM 6.5 CVE-2019-6693 KEVEPSS 6% Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup f… Fortios after 6.0.6 Fix from $1,6002019-11-21 CRITICAL 9.8 CVE-2018-13379 KEVEPSS 100% An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4… Fortiproxy 1.2.9 / 5.4.13+ Fix from $2,3002019-06-04 HIGH 7.5 CVE-2018-13382 KEVEPSS 82% An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, … Fortiproxy 1.2.9 / 5.4.11+ Fix from $1,9502019-06-04 MEDIUM 6.5 CVE-2018-13383 KEVEPSS 34% A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, … Fortiproxy 1.2.9 / 5.2.15+ Fix from $1,6002019-05-29