FO
Product
FortiAnalyzer
On CISA KEVExploited in the wild
97
CVEs
1
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 6High 32Medium 52Low 7
Watch
Add FortiAnalyzer to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-53845 | 6.5 | Oct 14 | An improper authentication vulnerability [CWE-287] in Fortinet FortiAnalyzer version 7.6.0 through 7.6.3 and before 7.4.6 allows an unauthenticated attacker to obtain information… Affected: 6.4.0 before 7.4.7; 7.6.0 before 7.6.4 |
| CVE-2024-40585 | 6.5 | Mar 14 | An insertion of sensitive information into log file vulnerabilities [CWE-532] in FortiManager version 7.4.0, version 7.2.3 and below, version 7.0.8 and below, version 6.4.12 and… Affected: 6.2.0 before 6.2.12; 6.4.0 before 6.4.13; 7.0.0 before 7.0.9; 7.2.0 before 7.2.4; 7.4.0 |
| CVE-2023-44254 | 6.5 | Sep 10 | An authorization bypass through user-controlled key [CWE-639] vulnerability in FortiAnalyzer version 7.4.1 and before 7.2.5 and FortiManager version 7.4.1 and before 7.2.5 may… Affected: 7.4.0; 7.2.0 through 7.2.4; 7.0.0 through 7.0.12; 6.4.0 through 6.4.14; 6.2.0 through 6.2.12 |
| CVE-2023-44256 | 6.5 | Oct 20 | A server-side request forgery vulnerability [CWE-918] in Fortinet FortiAnalyzer version 7.4.0, version 7.2.0 through 7.2.3 and before 7.0.8 and FortiManager version 7.4.0, version… Affected: 6.4.8 through 6.4.13; 7.0.2 through 7.0.8; 7.2.0 through 7.2.3; 7.4.0 |
| CVE-2023-44249 | 6.5 | Oct 10 | An authorization bypass through user-controlled key [CWE-639] vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiAnalyzer version 7.4.0 and before… Affected: 6.2.0 through 6.2.12; 6.4.0 through 6.4.13; 7.0.0 through 7.0.9; 7.2.0 before 7.2.4; 7.4.0 |
| CVE-2023-42787 | 6.5 | Oct 10 | A client-side enforcement of server-side security [CWE-602] vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiAnalyzer version 7.4.0 and before 7.2.3… Affected: 6.2.0 through 6.2.12; 6.4.0 through 6.4.13; 7.0.0 through 7.0.9; 7.2.0 through 7.2.3; 7.4.0 |
| CVE-2023-25606 | 6.5 | Jul 11 | An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-23] in FortiAnalyzer and FortiManager management interface 7.2.0 through… Affected: 6.4.0 before 6.4.12; 7.0.0 through 7.0.5; 7.2.0 before 7.2.2 |
| CVE-2023-25609 | 6.5 | Jun 13 | A server-side request forgery (SSRF) vulnerability [CWE-918] in FortiManager and FortiAnalyzer GUI 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.8 through 6.4.11 may allow a… Affected: 6.4.8 through 6.4.11; 7.0.0 through 7.0.6; 7.2.0; 7.2.1 |
| CVE-2022-27490 | 6.5 | Mar 7 | A exposure of sensitive information to an unauthorized actor in Fortinet FortiManager version 6.0.0 through 6.0.4, FortiAnalyzer version 6.0.0 through 6.0.4, FortiPortal version… Affected: 5.6.0 through 5.6.11; 6.0.0 through 6.0.4 |
| CVE-2021-32603 | 6.5 | Aug 5 | A server-side request forgery (SSRF) (CWE-918) vulnerability in FortiManager and FortiAnalyser GUI 7.0.0, 6.4.5 and below, 6.2.7 and below, 6.0.11 and below, 5.6.11 and below may… Affected: 5.6.0 before 6.2.8; 6.4.0 before 6.4.6; 7.0.0 before 7.0.1 |
| CVE-2018-1354 | 6.5 | Jun 27 | An improper access control vulnerability in Fortinet FortiManager 6.0.0, 5.6.5 and below versions, FortiAnalyzer 6.0.0, 5.6.5 and below versions allows a regular user edit the… Affected: through 6.0.0 |
| CVE-2022-30304 | 6.1 | Feb 16 | An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiAnalyzer versions prior to 7.2.1, 7.0.4 and 6.4.8 may allow a remote unauthenticated… Affected: 6.0.0 through 6.0.11; 6.2.0 through 6.2.9; 6.4.0 before 6.4.9; 7.0.0 before 7.0.5; 7.2.0; 7.2.1 |
| CVE-2020-12811 | 6.1 | Sep 24 | A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network… Affected: 6.2.7 through 6.2.11 |
| CVE-2018-13375 | 6.1 | May 28 | An Improper Neutralization of Script-Related HTML Tags in Fortinet FortiAnalyzer 5.6.0 and below and FortiManager 5.6.0 and below allows an attacker to send DHCP request… Affected: through 5.6.0 |
| CVE-2018-1355 | 6.1 | Jun 27 | An open redirect vulnerability in Fortinet FortiManager 6.0.0, 5.6.5 and below versions, FortiAnalyzer 6.0.0, 5.6.5 and below versions allows attacker to inject script code during… Affected: through 5.6.5; 6.0.0 |
| CVE-2024-36508 | 6.0 | Feb 11 | An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5 and… Affected: 6.4.0 before 7.2.6; 7.4.0 before 7.4.3 |
| CVE-2024-32116 | 6.0 | Nov 12 | Multiple relative path traversal vulnerabilities [CWE-23] in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5, FortiAnalyzer version 7.4.0 through 7.4.2 and… Affected: 6.2.0 before 7.2.6; 7.4.0 before 7.4.3 |
| CVE-2025-68482 | 5.9 | Mar 10 | A improper certificate validation vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.8, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0… Affected: 7.6.0 through 7.6.4; 7.4.0 through 7.4.8; 7.2.0 through 7.2.12; 7.0.0 through 7.0.16; 6.4.0 through 6.4.15 |
| CVE-2023-40719 | 5.5 | Nov 14 | A use of hard-coded credentials vulnerability in Fortinet FortiAnalyzer and FortiManager 7.0.0 - 7.0.8, 7.2.0 - 7.2.3 and 7.4.0 allows an attacker to access Fortinet private… Affected: 7.0.0 through 7.0.10; 7.2.0 through 7.2.3; 7.4.0 |
| CVE-2022-42477 | 5.5 | Apr 11 | An improper input validation vulnerability [CWE-20] in FortiAnalyzer version 7.2.1 and below, version 7.0.6 and below, 6.4 all versions may allow an authenticated attacker to… Affected: 6.4.0 before 7.0.7; 7.2.0 |
| CVE-2022-39950 | 5.4 | Nov 2 | An improper neutralization of input during web page generation vulnerability [CWE-79] exists in FortiManager and FortiAnalyzer 6.0.0 all versions, 6.2.0 all versions, 6.4.0… Affected: 6.0.0 through 6.2.9; 6.4.0 through 6.4.8; 7.0.0 through 7.0.4 |
| CVE-2020-12814 | 5.4 | Nov 2 | A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiAnalyzer version 6.0.6 and below, version 6.4.4 allows attacker to execute… Affected: 6.0.0 through 6.0.6; 6.4.4 |
| CVE-2021-24021 | 5.4 | Oct 6 | An improper neutralization of input vulnerability [CWE-79] in FortiAnalyzer versions 6.4.3 and below, 6.2.7 and below and 6.0.10 and below may allow a remote authenticated… Affected: 6.0.0 before 6.2.8; 6.4.0 before 6.4.4 |
| CVE-2021-32597 | 5.4 | Aug 6 | Multiple improper neutralization of input during web page generation (CWE-79) in FortiManager and FortiAnalyzer versions 7.0.0, 6.4.5 and below, 6.2.7 and below user interface,… Affected: before 6.2.8; 6.4.0 before 6.4.6; 7.0.0 before 7.0.1 |
| CVE-2020-12815 | 5.4 | Sep 24 | An improper neutralization of input vulnerability in FortiTester before 3.9.0 may allow a remote authenticated attacker to inject script related HTML tags via IPv4/IPv6 address… Affected: through 6.2.5; 6.4.0 through 6.4.1 |
| CVE-2020-6640 | 5.4 | Jun 4 | An improper neutralization of input vulnerability in the Admin Profile of FortiAnalyzer may allow a remote authenticated attacker to perform a stored cross site scripting attack… Affected: before 6.2.4 |
| CVE-2025-67604 | 5.3 | May 12 | A use of potentially dangerous function vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.8, FortiAnalyzer 7.2 all versions,… Affected: 7.6.0 through 7.6.4; 7.4.0 through 7.4.8; 7.2.0 through 7.2.12; 7.0.0 through 7.0.16; 6.4.0 through 6.4.15 |
| CVE-2025-54973 | 5.3 | Oct 14 | A concurrent execution using shared resource with improper synchronization ('Race Condition') vulnerability [CWE-362] in Fortinet FortiAnalyzer version 7.6.0 through 7.6.2, 7.4.0… Affected: 7.0.9 before 7.0.14; 7.2.0 before 7.2.11; 7.4.0 before 7.4.7; 7.6.0 before 7.6.3 |
| CVE-2024-52962 | 5.3 | Apr 8 | An Improper Output Neutralization for Logs vulnerability [CWE-117] in FortiAnalyzer version 7.6.1 and below, version 7.4.5 and below, version 7.2.8 and below, version 7.0.13 and… Affected: 7.0.0 before 7.0.14; 7.2.0 before 7.2.9; 7.4.0 before 7.4.6; 7.6.0 before 7.6.2 |
| CVE-2023-42782 | 5.3 | Oct 10 | A insufficient verification of data authenticity vulnerability [CWE-345] in FortiAnalyzer version 7.4.0 and below 7.2.3 allows a remote unauthenticated attacker to send messages… Affected: 6.2.0 through 6.2.12; 6.4.0 through 6.4.13; 7.0.0 through 7.0.9; 7.2.0 through 7.2.3; 7.4.0 |
| CVE-2022-26121 | 5.3 | Oct 10 | An exposure of resource to wrong sphere vulnerability [CWE-668] in FortiAnalyzer and FortiManager GUI 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.0 through 6.2.9, 6.0.0 through… Affected: after 5.6.0 through 5.6.11; after 6.0.0 through 6.0.11; after 6.2.0 through 6.2.9; after 6.4.0 through 6.4.8; after 7.0.0 through 7.0.3 |
| CVE-2023-44253 | 5.0 | Feb 15 | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in Fortinet FortiManager version 7.4.0 through 7.4.1 and before 7.2.5, FortiAnalyzer version… Affected: 6.2.0 through 6.2.12; 6.4.0 through 6.4.14; 7.0.0 through 7.0.11; 7.2.0 through 7.2.3; 7.4.0; 7.4.1 |
| CVE-2024-32117 | 4.9 | Nov 12 | An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiManager version 7.4.0 through 7.4.2 and below 7.2.5,… Affected: 6.2.0 before 7.2.6; 7.4.0 before 7.4.3 |
| CVE-2024-40593 | 4.4 | Dec 11 | A key management errors vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.2, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all… Affected: 7.4.0 through 7.4.2; 7.2.0 through 7.2.5; 7.0.0 through 7.0.15; 6.4.0 through 6.4.15 |
| CVE-2021-24022 | 4.4 | Jul 20 | A buffer overflow vulnerability in FortiAnalyzer CLI 6.4.5 and below, 6.2.7 and below, 6.0.x and FortiManager CLI 6.4.5 and below, 6.2.7 and below, 6.0.x may allow an… Affected: 6.0.0 before 6.2.8; 6.4.0 before 6.4.6 |
| CVE-2023-36638 | 4.3 | Sep 13 | An improper privilege management vulnerability [CWE-269] in FortiManager 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions and… Affected: 6.0.0 before 6.4.12; 7.0.0 before 7.0.8; 7.2.0 before 7.2.3 |
| CVE-2021-32587 | 4.3 | Aug 6 | An improper access control vulnerability in FortiManager and FortiAnalyzer GUI interface 7.0.0, 6.4.5 and below, 6.2.8 and below, 6.0.11 and below, 5.6.11 and below may allow a… Affected: 5.6.0 before 6.4.6; 7.0.0 before 7.0.1 |
| CVE-2021-32598 | 4.3 | Aug 5 | An improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting') vulnerability In FortiManager and FortiAnalyzer GUI 7.0.0, 6.4.6 and below, 6.2.8 and… Affected: 5.6.0 before 7.0.1 |
| CVE-2022-22305 | 4.2 | Sep 1 | An improper certificate validation vulnerability [CWE-295] in FortiManager 7.0.1 and below, 6.4.6 and below; FortiAnalyzer 7.0.2 and below, 6.4.7 and below; FortiOS 6.2.x and… Affected: 6.0.0 through 6.0.12; 6.2.9 through 6.4.7; 7.0.0; 7.0.1; 7.0.2 |
| CVE-2023-44255 | 4.1 | Nov 12 | An exposure of sensitive information to an unauthorized actor [CWE-200] in Fortinet FortiManager before 7.4.2, FortiAnalyzer before 7.4.2 and FortiAnalyzer-BigData before 7.2.5… Affected: 6.2.0 before 7.4.3 |
| CVE-2026-22629 | 3.7 | Mar 10 | An improper restriction of excessive authentication attempts vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4 all versions, FortiAnalyzer 7.2 all… Affected: 7.6.0 through 7.6.4; 7.4.0 through 7.4.10; 7.2.0 through 7.2.12; 7.0.0 through 7.0.16; 6.4.0 through 6.4.15 |
| CVE-2021-36170 | 3.2 | Oct 6 | An information disclosure vulnerability [CWE-200] in FortiAnalyzerVM and FortiManagerVM versions 7.0.0 and 6.4.6 and below may allow an authenticated attacker to read the… Affected: before 6.4.7; 7.0.0 through 7.0.1 |
| CVE-2023-23776 | 3.1 | Mar 7 | An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in FortiAnalyzer versions 7.2.0 through 7.2.1, 7.0.0 through 7.0.4 and 6.4.0 through 6.4.10… Affected: 6.4.0 before 6.4.11; 7.0.0 before 7.0.5; 7.2.0 before 7.2.2 |
| CVE-2025-24474 | 2.7 | Jul 8 | An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiManager 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, 7.2 all… Affected: 6.4.0 before 7.4.7; 7.6.0 before 7.6.2 |
| CVE-2022-38377 | 2.7 | Nov 25 | An improper access control vulnerability [CWE-284] in FortiManager 7.2.0, 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2.0 through 6.2.9, 6.0.0 through 6.0.11 and FortiAnalyzer… Affected: 6.0.0 through 6.0.12; 6.2.0 through 6.2.10; 6.4.0 through 6.4.8; 7.0.0 through 7.0.3; 7.2.0 |
| CVE-2024-52966 | 2.3 | Feb 11 | An exposure of sensitive information to an unauthorized actor in Fortinet FortiAnalyzer 6.4.0 through 7.6.0 allows attacker to cause information disclosure via filter manipulation Affected: 6.4.0 before 7.2.8; 7.4.0 before 7.4.5; 7.6.0 |
| CVE-2024-35274 | 2.3 | Nov 12 | An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiAnalyzer versions below 7.4.2, Fortinet FortiManager… Affected: 6.2.0 before 7.4.3 |