Fortinet: exploited vulnerabilities
- 32exploited vulnerabilities
- 14used by ransomware
- Oct 16, 2026latest one added
- FortiOS 9
- Multiple Products 7
- FortiOS and FortiProxy 4
- FortiClient EMS 3
- FortiWeb 3
- FortiSandbox 2
- FortiMail 1
- FortiManager 1
- FortiOS and FortiProxy SSL-VPN 1
- FortiOS and FortiADC 1
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Oct 16, 2026 | Path Traversal | Multiple Products | Medium 5.4 | 1.3% |
| Oct 1, 2026 | Path Traversal | FortiMail | Critical 9.8 | 4.6% |
| Sep 9, 2026 | Heap-based Buffer Overflow | Multiple Products | High 7.4 | 3.7% |
| Jul 27, 2026 | Exposure of Sensitive Information to an Unauthorized Actor | FortiOS | Medium 5.3 | 29% |
| Jul 16, 2026 | OS Command Injection | FortiSandbox | Critical 9.1 | 93% |
| Jul 16, 2026 | OS Command Injection | FortiSandbox | Critical 9.1 | 76% |
| Apr 13, 2026 | SQL Injection | FortiClient EMS | Critical 9.1 | 98% |
| Apr 6, 2026 | Improper Access Control | FortiClient EMS | Critical 9.1 | 94% |
| Jan 27, 2026 | Authentication Bypass Using an Alternate Path or Channel | Multiple Products | Critical 9.4 | 87% |
| Dec 16, 2025 | Improper Verification of Cryptographic Signature | Multiple Products | Critical 9.1 | 68% |
| Nov 18, 2025 | OS Command Injection | FortiWeb | Medium 6.7 | 55% |
| Nov 14, 2025 | Path Traversal | FortiWeb | Critical 9.4 | 91% |
| Jul 18, 2025 | SQL Injection | FortiWeb | Critical 9.6 | 99.9% |
| Jun 25, 2025 | Use of Hard-Coded Credentials | FortiOS | Medium 6.5 | 6.6% |
| May 14, 2025 | Stack-Based Buffer Overflow | Multiple Products | Critical 9.6 | 31% |
| Mar 18, 2025 | Authentication Bypass | FortiOS and FortiProxy | High 8.1 | 7.2% |
| Jan 14, 2025 | Authentication Bypass | FortiOS and FortiProxy | Critical 9.6 | 94% |
| Oct 23, 2024 | Missing Authentication | FortiManager | Critical 9.8 | 95% |
| Oct 9, 2024 | Format String | Multiple Products | Critical 9.8 | 62% |
| Mar 25, 2024 | SQL Injection | FortiClient EMS | Critical 9.3 | 98% |
| Feb 9, 2024 | Out-of-Bound Write | FortiOS | Critical 9.6 | 85% |
| Jun 13, 2023 | Heap-Based Buffer Overflow | FortiOS and FortiProxy SSL-VPN | Critical 9.2 | 86% |
| Mar 14, 2023 | Path Traversal | FortiOS | Medium 6.5 | 11% |
| Dec 13, 2022 | Heap-Based Buffer Overflow | FortiOS | Critical 9.3 | 99.5% |
| Oct 11, 2022 | Authentication Bypass | Multiple Products | Critical 9.8 | >99.9% |
| Sep 8, 2022 | Improper Access Control | FortiOS and FortiADC | Medium 4.3 | 38% |
| Jan 10, 2022 | Out-of-bounds Write | FortiOS and FortiProxy | Medium 4.3 | 34% |
| Jan 10, 2022 | Improper Authorization | FortiOS and FortiProxy | Critical 9.1 | 82% |
| Dec 10, 2021 | Arbitrary File Download | FortiOS | Low 3.3 | 0.9% |
| Nov 3, 2021 | SSL VPN Improper Authentication | FortiOS | High 7.5 | 45% |
| Nov 3, 2021 | Default Configuration | FortiOS | Medium 6.5 | 19% |
| Nov 3, 2021 | SSL VPN Path Traversal | FortiOS | Critical 9.1 | >99.9% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.