FO
Product
FortiADC
On CISA KEVExploited in the wildRansomware-linked
43
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 17Medium 23Low 1
Watch
Add FortiADC to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-13374 RansomwareIn wildKEV | 4.3 | Jan 22 | Fortinet FortiOS and FortiADC Improper Access Control Vulnerability Affected: 5.4.0 before 5.4.5; 6.0.0 before 6.0.2; 6.1.0 |
| CVE-2022-38381 | 9.8 | Nov 2 | An improper handling of malformed request vulnerability [CWE-228] exists in FortiADC 5.0 all versions, 6.0.0 all versions, 6.1.0 all versions, 6.2.0 through 6.2.3, and 7.0.0… Affected: 5.0.0 through 5.0.4; 5.1.0 through 5.1.7; 5.2.0 through 5.2.8; 5.3.0 through 5.3.7; 5.4.0 through 5.4.5; 6.0.0 through 6.0.4; +3 more |
| CVE-2023-25603 | 9.1 | Nov 14 | A permissive cross-domain policy with untrusted domains vulnerability in Fortinet FortiADC 7.1.0 - 7.1.1, FortiDDoS-F 6.3.0 - 6.3.4 and 6.4.0 - 6.4.1 allow an unauthorized… Affected: 7.1.0; 7.1.1 |
| CVE-2023-26205 | 8.8 | Nov 14 | An improper access control vulnerability [CWE-284] in FortiADC automation feature 7.1.0 through 7.1.2, 7.0 all versions, 6.2 all versions, 6.1 all versions may allow an… Affected: 6.1.0 through 6.1.6; 6.2.0 through 6.2.6; 7.0.0 through 7.0.5; 7.1.0; 7.1.1; 7.1.2 |
| CVE-2022-35849 | 8.8 | Sep 13 | An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiADC 7.1.0 through 7.1.1, 7.0.0 through 7.0.3, 6.2.0… Affected: before 6.2.6; 7.0.0 before 7.0.4; 7.1.0 before 7.1.2 |
| CVE-2022-39947 | 8.8 | Jan 3 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiADC version 7.0.0 through 7.0.2, FortiADC version 6.2.0 through… Affected: 5.4.0 through 5.4.5; 6.0.0 through 6.0.4; 6.1.0 through 6.1.6; 6.2.0 through 6.2.3; 7.0.0; 7.0.1 |
| CVE-2022-33875 | 8.8 | Dec 6 | An improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability in Fortinet FortiADC version 7.1.0, version 7.0.0 through 7.0.2 and version… Affected: 5.2.0 through 6.2.4; 7.0.0; 7.0.1; 7.0.2; 7.1.0 |
| CVE-2022-26120 | 8.8 | Jul 18 | Multiple improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerabilities [CWE-89] in FortiADC management interface 7.0.0 through 7.0.1, 5.0.0… Affected: 5.0.0 before 6.2.3; 7.0.0; 7.0.1 |
| CVE-2023-25607 | 7.8 | Oct 10 | An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78 ] in FortiManager 7.2.0 through 7.2.2, 7.0.0 through 7.0.7,… Affected: 6.0.0 through 6.0.4; 6.1.0 through 6.1.6; 6.2.0 through 6.2.6; 7.0.0 through 7.0.3; 7.1.0 |
| CVE-2023-28000 | 7.8 | Jun 13 | An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC CLI 7.1.0, 7.0.0 through 7.0.3, 6.2.0 through 6.2.4, 6.1 all versions, 6.0… Affected: 6.0.0 through 6.0.4; 6.1.0 through 6.1.6; 6.2.0 through 6.2.4; 7.0.0 through 7.0.3; 7.1.0 |
| CVE-2023-26210 | 7.8 | Jun 13 | Multiple improper neutralization of special elements used in an os command ('OS Command Injection') vulnerabilties [CWE-78] vulnerability in Fortinet allows a local authenticated… Affected: 5.2.0 through 5.2.8; 5.3.0 through 5.3.7; 5.4.0 through 5.4.5; 6.0.0 through 6.0.4; 6.1.0 through 6.1.6; 6.2.0 through 6.2.6; +5 more |
| CVE-2023-27999 | 7.8 | May 3 | An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC 7.2.0, 7.1.0 through 7.1.1 may allow an authenticated attacker to execute… Affected: 7.1.0 before 7.1.2; 7.2.0 |
| CVE-2022-43948 | 7.8 | Apr 11 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 7.0.0 through 7.0.3, FortiADC version 7.1.0 through… Affected: 5.1.0 before 6.2.6; 7.0.0 before 7.0.4; 7.1.0 before 7.1.2 |
| CVE-2022-40679 | 7.8 | Apr 11 | An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC 5.x all versions, 6.0 all versions, 6.1 all versions, 6.2.0 through 6.2.4,… Affected: 5.0.0 before 6.2.5 |
| CVE-2022-27482 | 7.8 | Feb 16 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiADC version 7.0.0 through 7.0.1, 6.2.0 through 6.2.2, 6.1.0 through… Affected: 5.0.0 through 5.0.4; 5.1.0 through 5.1.7; 5.2.0 through 5.2.8; 5.3.0 through 5.3.7; 5.4.0 through 5.4.5; 6.0.0 through 6.0.4; +4 more |
| CVE-2022-22299 | 7.8 | Aug 5 | A format string vulnerability [CWE-134] in the command line interpreter of FortiADC version 6.0.0 through 6.0.4, FortiADC version 6.1.0 through 6.1.5, FortiADC version 6.2.0… Affected: 6.0.0 through 6.0.4; 6.1.0 through 6.1.6; 6.2.0; 6.2.1 |
| CVE-2023-50178 | 7.4 | Jul 9 | An improper certificate validation vulnerability [CWE-295] in FortiADC 7.4.0, 7.2.0 through 7.2.3, 7.1 all versions, 7.0 all versions, 6.2 all versions, 6.1 all versions and 6.0… Affected: 6.0.0 through 6.0.4; 6.1.0 through 6.1.6; 6.2.0 through 6.2.6; 7.0.0 through 7.0.2; 7.1.0 through 7.2.3; 7.4.0 |
| CVE-2025-49813 | 7.2 | Aug 12 | An improper neutralization of special elements used in an OS Command ("OS Command Injection") vulnerability [CWE-78] in Fortinet FortiADC version 7.2.0 and before 7.1.1 allows a… Affected: 6.2.0 through 6.2.6; 7.1.0 before 7.1.2; 7.2.0 |
| CVE-2025-31104 | 7.2 | Jun 10 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiADC 7.6.0 through 7.6.1, FortiADC 7.4.0 through 7.4.6,… Affected: 6.1.0 before 7.1.5; 7.2.0 before 7.2.8; 7.4.0 before 7.4.7; 7.6.0 before 7.6.2 |
| CVE-2023-27993 | 7.1 | May 3 | A relative path traversal [CWE-23] in Fortinet FortiADC version 7.2.0 and before 7.1.1 allows a privileged attacker to delete arbitrary directories from the underlying file system… Affected: 5.2.0 through 7.0.5; 7.1.0 before 7.1.2; 7.2.0 |
| CVE-2023-29177 | 6.7 | Nov 14 | Multiple buffer copy without checking size of input ('classic buffer overflow') vulnerabilities [CWE-120] in FortiADC version 7.2.0 and before 7.1.2 & FortiDDoS-F version 6.5.0… Affected: 7.1.0 through 7.1.2; 5.2.0; 5.3.0; 5.4.0; 6.0.0; 6.1.0; +3 more |
| CVE-2021-42757 | 6.7 | Dec 8 | A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to achieve arbitrary code… Affected: 5.0.0 through 6.1.5; 6.2.0 through 6.2.2 |
| CVE-2025-48839 | 6.6 | Nov 18 | An Out-of-bounds Write vulnerability [CWE-787] in FortiADC 8.0.0, 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, 7.2 all versions, 7.1 all versions, 7.0 all versions, 6.2 all versions… Affected: 6.2.0 before 7.4.8; 7.6.0 before 7.6.3; 8.0.0 |
| CVE-2025-54971 | 6.5 | Nov 18 | An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiADC 7.4.0, FortiADC 7.2 all versions, FortiADC 7.1 all versions, FortiADC 7.0 all… Affected: 6.2.0 before 7.4.3 |
| CVE-2025-59921 | 6.5 | Oct 14 | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in Fortinet FortiADC version 7.4.0, version 7.2.3 and below, version 7.1.4 and below, 7.0 all… Affected: 6.2.0 before 7.1.5; 7.2.0 before 7.2.4; 7.4.0 |
| CVE-2023-50181 | 6.5 | Jul 9 | An improper access control vulnerability [CWE-284] in Fortinet FortiADC version 7.4.0 through 7.4.1 and before 7.2.4 allows a read only authenticated attacker to perform some… Affected: 6.0.0 before 7.2.5; 7.4.0 before 7.4.2 |
| CVE-2022-33876 | 6.5 | Dec 6 | Multiple instances of improper input validation vulnerability in Fortinet FortiADC version 7.1.0, version 7.0.0 through 7.0.2 and version 6.2.4 and below allows an authenticated… Affected: 5.1.0 through 6.2.4; 7.0.0; 7.0.1; 7.0.2; 7.1.0 |
| CVE-2021-43076 | 6.5 | Sep 6 | An improper privilege management vulnerability [CWE-269] in FortiADC versions 6.2.1 and below, 6.1.5 and below, 6.0.4 and below, 5.4.5 and below and 5.3.7 and below may allow a… Affected: 5.3.0 through 5.3.7; 5.4.0 through 5.4.5; 6.0.0 through 6.0.4; 6.1.0 through 6.1.5; 6.2.0; 6.2.1 |
| CVE-2021-24024 | 6.5 | Apr 12 | A clear text storage of sensitive information into log file vulnerability in FortiADCManager 5.3.0 and below, 5.2.1 and below and FortiADC 5.3.7 and below may allow a remote… Affected: through 5.3.7 |
| CVE-2025-58412 | 6.1 | Nov 19 | A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiADC 8.0.0, FortiADC 7.6.0 through 7.6.3, FortiADC 7.4 all versions,… Affected: 7.2.0 before 7.6.4; 8.0.0 |
| CVE-2023-37933 | 6.1 | Mar 11 | An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiADC GUI version 7.4.0, 7.2.0 through 7.2.1 and before 7.1.3… Affected: 5.3.0 before 7.1.4; 7.2.0 before 7.2.2; 7.4.0 |
| CVE-2022-23439 | 6.1 | Jan 22 | A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafted HTTP requests, where the `Host`… Affected: 5.4.0 before 6.2.4 |
| CVE-2022-38374 | 6.1 | Nov 2 | A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiADC 7.0.0 - 7.0.2 and 6.2.0 - 6.2.4 allows an attacker to execute… Affected: 6.2.0 before 6.2.4; 7.0.0 before 7.0.3 |
| CVE-2023-50179 | 5.9 | Jul 9 | An improper certificate validation vulnerability [CWE-295] in FortiADC 7.4.0, 7.2 all versions, 7.1 all versions, 7.0 all versions may allow a remote and unauthenticated attacker… Affected: 7.0.0 before 7.4.1 |
| CVE-2023-50180 | 5.5 | May 14 | An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiADC version 7.4.1 and below, version 7.2.3 and below, version 7.1.4… Affected: through 6.2.6; 7.0.0 through 7.0.5; 7.1.0 through 7.1.4; 7.2.0 through 7.2.3; 7.4.0; 7.4.1 |
| CVE-2023-41673 | 5.4 | Dec 13 | An improper authorization vulnerability [CWE-285] in Fortinet FortiADC version 7.4.0 and before 7.2.2 may allow a low privileged user to read or backup the full system… Affected: 6.0.0 through 6.0.4; 6.1.0 through 6.1.6; 6.2.0 through 6.2.6; 7.0.0 through 7.0.5; 7.1.0; 7.1.1; +3 more |
| CVE-2022-43952 | 5.4 | Apr 11 | An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiADC version 7.1.1 and below, version 7.0.3 and below,… Affected: 6.2.0 before 6.2.6; 7.0.0 before 7.0.4; 7.1.0 before 7.1.2 |
| CVE-2022-35851 | 5.4 | Nov 2 | An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiADC management interface 7.1.0 may allow a remote and authenticated attacker to… Affected: 7.1.0 |
| CVE-2019-6699 | 5.4 | Mar 13 | An improper neutralization of input vulnerability in Fortinet FortiADC 5.3.3 and earlier may allow an attacker to execute a stored Cross Site Scripting (XSS) via a field in the… Affected: through 5.3.3 |
| CVE-2021-32591 | 5.3 | Dec 8 | A missing cryptographic steps vulnerability in the function that encrypts users' LDAP and RADIUS credentials in FortiSandbox before 4.0.1, FortiWeb before 6.3.12, FortiADC before… Affected: 5.0.0 through 5.4.4; 6.0.0 through 6.0.3; 6.1.0 through 6.1.3; 6.2.0; 6.2.1 |
| CVE-2022-27484 | 4.3 | Aug 3 | A unverified password change in Fortinet FortiADC version 6.2.0 through 6.2.3, 6.1.x, 6.0.x, 5.x.x allows an authenticated attacker to bypass the Old Password check in the… Affected: 5.0.0 before 6.2.4 |
| CVE-2020-15935 | 4.3 | Nov 2 | A cleartext storage of sensitive information in GUI in FortiADC versions 5.4.3 and below, 6.0.0 and below may allow a remote authenticated attacker to retrieve some sensitive… Affected: 5.0.0 through 5.4.3; 6.0.0 through 6.0.1 |
| CVE-2024-36511 | 3.7 | Sep 10 | An improperly implemented security check for standard vulnerability [CWE-358] in FortiADC Web Application Firewall (WAF) 7.4.0 through 7.4.4, 7.2 all versions, 7.1 all versions,… Affected: 7.4.0 through 7.4.4; 7.2.0 through 7.2.7; 7.1.0 through 7.1.4; 7.0.0 through 7.0.5; 6.2.0 through 6.2.6; 6.1.0 through 6.1.6; +1 more |
Showing 43