Fortinet vulnerabilities in CISA KEV
Fortinet has 32 vulnerabilities in CISA's catalogue of flaws known to be exploited, the 9th highest of any vendor. 12 were added in the last 12 months; 14 are linked to known ransomware use (43.8% of its entries, against 20.4% across the catalogue). CISA's median fix window for these entries is 21 days (range 3 to 181), against 21 days (range 1 to 184) across the whole catalogue. The most exploited product is FortiOS, with 9 entries. Other frequently affected products: Multiple Products (7); FortiOS and FortiProxy (4).
Catalog v2026.11.04, released 5 Nov 2026. Source CISA ↗. All KEV entries.
$ ./kev --vendor fortinet --summary
Counts are computed from the catalog release on ; the 12 month window ends there.
┌─ total entries
32
in CISA KEV
┌─ first added
2021-11-03
earliest entry
┌─ latest added
2026-10-16
most recent entry
┌─ last 12 months
12
entries added
┌─ ransomware use
14 of 32
43.8% linked to ransomware
┌─ distinct products
10
affected products
$ awk -F, {print $1} /var/log/kev/fortinet.log | uniq -c
Entries by the year CISA added them.
| Year | Entries added | Of which ransomware |
|---|---|---|
| 2021 | 4 | 3 |
| 2022 | 5 | 5 |
| 2023 | 2 | 1 |
| 2024 | 4 | 2 |
| 2025 | 8 | 3 |
| 2026 | 9 | 0 |
$ sort /var/log/kev/fortinet.log | uniq -c | sort -rn | head -5
The five products with the most entries in the catalogue.
- FortiOS 9 entries
- Multiple Products 7 entries
- FortiOS and FortiProxy 4 entries
- FortiClient EMS 3 entries
- FortiWeb 3 entries
$ kev-due-dates --vendor fortinet
Days between the date CISA added an entry and the due date it set, median and range. Due dates apply to US federal agencies; for everyone else they are a patch-first ranking signal.
┌─ Fortinet
21 days (range 3 to 181)
median and range in days
┌─ whole catalogue
21 days (range 1 to 184)
median and range in days
$ grep -o 'CWE-[0-9]*' /var/log/kev/fortinet.log | sort | uniq -c | sort -rn | head -3
Weakness types CISA records for these entries (32 of 32 have at least one CWE).
$ grep -ril 'Fortinet' /var/log/news | head -5
Our reporting that names Fortinet or one of its KEV CVE ids, newest first.
┌─ /var/log/news
Patch Week pages with these entries
$ wc -l ./fortinet.kev · 32 rows
Descriptions: CISA Known Exploited Vulnerabilities catalogue
- CVE-2025-61624
Multiple Products
Fortinet Multiple Products Path Traversal Vulnerability
due 2026-10-19 · CWE-22
$ cat CVE-2025-61624.txt
Description. FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2026-104286
FortiMail
Fortinet FortiMail Path Traversal Vulnerability
due 2026-10-04 · CWE-22 CWE-158
$ cat CVE-2026-104286.txt
Description. Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2025-25249
Multiple Products
Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability
due 2026-09-12 · CWE-122 CWE-787
$ cat CVE-2025-25249.txt
Description. Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2025-68686
FortiOS
Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
due 2026-08-10 · CWE-200
$ cat CVE-2025-68686.txt
Description. Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2026-25089
FortiSandbox
Fortinet FortiSandbox OS Command Injection Vulnerability
due 2026-07-19 · CWE-78
$ cat CVE-2026-25089.txt
Description. Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2026-39808
FortiSandbox
Fortinet FortiSandbox OS Command Injection Vulnerability
due 2026-07-19 · CWE-78
$ cat CVE-2026-39808.txt
Description. Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2026-21643
FortiClient EMS
Fortinet FortiClient EMS SQL Injection Vulnerability
due 2026-04-16 · CWE-89
$ cat CVE-2026-21643.txt
Description. Fortinet FortiClient EMS contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2026-35616
FortiClient EMS
Fortinet FortiClient EMS Improper Access Control Vulnerability
due 2026-04-09 · CWE-284
$ cat CVE-2026-35616.txt
Description. Fortinet FortiClient EMS contains an improper access control vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2026-24858
Multiple Products
Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability
due 2026-01-30 · CWE-288
$ cat CVE-2026-24858.txt
Description. Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authentication bypass using an alternate path or channel that could allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2025-59718
Multiple Products
Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability
due 2025-12-23 · CWE-347
$ cat CVE-2025-59718.txt
Description. Fortinet FortiOS, FortiSwitchMaster, FortiProxy, and FortiWeb contain an improper verification of cryptographic signature vulnerability that may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML message. Please be aware that CVE-2025-59719 pertains to the same problem and is mentioned in the same vendor advisory. Ensure to apply all patches mentioned in the advisory.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2025-58034
FortiWeb
Fortinet FortiWeb OS Command Injection Vulnerability
due 2025-11-25 · CWE-78
$ cat CVE-2025-58034.txt
Description. Fortinet FortiWeb contains an OS command Injection vulnerability that may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2025-64446
FortiWeb
Fortinet FortiWeb Path Traversal Vulnerability
due 2025-11-21 · CWE-23
$ cat CVE-2025-64446.txt
Description. Fortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2025-25257
FortiWeb
Fortinet FortiWeb SQL Injection Vulnerability
due 2025-08-08 · CWE-89
$ cat CVE-2025-25257.txt
Description. Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2019-6693
FortiOS [RANSOMWARE]
Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability
due 2025-07-16 · CWE-798
$ cat CVE-2019-6693.txt
Description. Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2025-32756
Multiple Products
Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability
due 2025-06-04 · CWE-124
$ cat CVE-2025-32756.txt
Description. Fortinet FortiFone, FortiVoice, FortiNDR and FortiMail contain a stack-based overflow vulnerability that may allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted HTTP requests.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2025-24472
FortiOS and FortiProxy [RANSOMWARE]
Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
due 2025-04-08 · CWE-288
$ cat CVE-2025-24472.txt
Description. Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2024-55591
FortiOS and FortiProxy [RANSOMWARE]
Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
due 2025-01-21 · CWE-288
$ cat CVE-2024-55591.txt
Description. Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that may allow an unauthenticated, remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2024-47575
FortiManager
Fortinet FortiManager Missing Authentication Vulnerability
due 2024-11-13 · CWE-306
$ cat CVE-2024-47575.txt
Description. Fortinet FortiManager contains a missing authentication vulnerability in the fgfmd daemon that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2024-23113
Multiple Products
Fortinet Multiple Products Format String Vulnerability
due 2024-10-30 · CWE-134
$ cat CVE-2024-23113.txt
Description. Fortinet FortiOS, FortiPAM, FortiProxy, and FortiWeb contain a format string vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-48788
FortiClient EMS [RANSOMWARE]
Fortinet FortiClient EMS SQL Injection Vulnerability
due 2024-04-15 · CWE-89
$ cat CVE-2023-48788.txt
Description. Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an unauthenticated attacker to execute commands as SYSTEM via specifically crafted requests.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2024-21762
FortiOS [RANSOMWARE]
Fortinet FortiOS Out-of-Bound Write Vulnerability
due 2024-02-16 · CWE-787
$ cat CVE-2024-21762.txt
Description. Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remote unauthenticated attacker to execute code or commands via specially crafted HTTP requests.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-27997
FortiOS and FortiProxy SSL-VPN [RANSOMWARE]
Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability
due 2023-07-04 · CWE-122
$ cat CVE-2023-27997.txt
Description. Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests.
Required action. Apply updates per vendor instructions.
- CVE-2022-41328
FortiOS
Fortinet FortiOS Path Traversal Vulnerability
due 2023-04-04 · CWE-22
$ cat CVE-2022-41328.txt
Description. Fortinet FortiOS contains a path traversal vulnerability that may allow a local privileged attacker to read and write files via crafted CLI commands.
Required action. Apply updates per vendor instructions.
- CVE-2022-42475
FortiOS [RANSOMWARE]
Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability
due 2023-01-03 · CWE-197
$ cat CVE-2022-42475.txt
Description. Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.
Required action. Apply updates per vendor instructions.
- CVE-2022-40684
Multiple Products [RANSOMWARE]
Fortinet Multiple Products Authentication Bypass Vulnerability
due 2022-11-01 · CWE-288
$ cat CVE-2022-40684.txt
Description. Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.
Required action. Apply updates per vendor instructions.
- CVE-2018-13374
FortiOS and FortiADC [RANSOMWARE]
Fortinet FortiOS and FortiADC Improper Access Control Vulnerability
due 2022-09-29 · CWE-732
$ cat CVE-2018-13374.txt
Description. Fortinet FortiOS and FortiADC contain an improper access control vulnerability that allows attackers to obtain the LDAP server login credentials configured in FortiGate by pointing a LDAP server connectivity test request to a rogue LDAP server.
Required action. Apply updates per vendor instructions.
- CVE-2018-13382
FortiOS and FortiProxy [RANSOMWARE]
Fortinet FortiOS and FortiProxy Improper Authorization
due 2022-07-10 · CWE-285
$ cat CVE-2018-13382.txt
Description. An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password.
Required action. Apply updates per vendor instructions.
- CVE-2018-13383
FortiOS and FortiProxy [RANSOMWARE]
Fortinet FortiOS and FortiProxy Out-of-bounds Write
due 2022-07-10 · CWE-787
$ cat CVE-2018-13383.txt
Description. A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users.
Required action. Apply updates per vendor instructions.
- CVE-2021-44168
FortiOS
Fortinet FortiOS Arbitrary File Download
due 2021-12-24 · CWE-494
$ cat CVE-2021-44168.txt
Description. Fortinet FortiOS "execute restore src-vis" downloads code without integrity checking, allowing an attacker to arbitrarily download files.
Required action. Apply updates per vendor instructions.
- CVE-2018-13379
FortiOS [RANSOMWARE]
Fortinet FortiOS SSL VPN Path Traversal Vulnerability
due 2022-05-03 · CWE-22
$ cat CVE-2018-13379.txt
Description. Fortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests.
Required action. Apply updates per vendor instructions.
- CVE-2019-5591
FortiOS [RANSOMWARE]
Fortinet FortiOS Default Configuration Vulnerability
due 2022-05-03 · CWE-306
$ cat CVE-2019-5591.txt
Description. Fortinet FortiOS contains a default configuration vulnerability that may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the Lightweight Directory Access Protocol (LDAP) server.
Required action. Apply updates per vendor instructions.
- CVE-2020-12812
FortiOS [RANSOMWARE]
Fortinet FortiOS SSL VPN Improper Authentication Vulnerability
due 2022-05-03 · CWE-178 CWE-287
$ cat CVE-2020-12812.txt
Description. Fortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to login successfully without being prompted for the second factor of authentication (FortiToken) if they change the case in their username.
Required action. Apply updates per vendor instructions.