FO
Product
Forticlient
86
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 52Medium 21Low 3
Watch
Add Forticlient to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-40681 | 7.1 | Nov 14 | A incorrect authorization in Fortinet FortiClient (Windows) 7.0.0 - 7.0.7, 6.4.0 - 6.4.9, 6.2.0 - 6.2.9 and 6.0.0 - 6.0.10 allows an attacker to cause denial of service via… Affected: 6.0.0 through 6.0.10; 6.2.0 through 6.2.9; 6.4.0 through 6.4.8; 7.0.0 through 7.0.7 |
| CVE-2022-26113 | 7.1 | Jul 19 | An execution with unnecessary privileges vulnerability [CWE-250] in FortiClientWindows 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2.0 through 6.2.9, 6.0.0 through 6.0.10 may… Affected: 6.0.0 through 6.0.10; 6.2.0 through 6.2.9; 6.4.0 through 6.4.7; 7.0.0 through 7.0.3 |
| CVE-2019-16155 | 7.1 | Feb 7 | A privilege escalation vulnerability in FortiClient for Linux 6.2.1 and below may allow a user with low privilege to overwrite system files as root with arbitrary content through… Affected: through 6.2.1 |
| CVE-2024-40586 | 6.7 | Feb 11 | An Improper Access Control vulnerability [CWE-284] in FortiClient Windows version 7.4.0, version 7.2.6 and below, version 7.0.13 and below may allow a local user to escalate his… Affected: 7.0.3 before 7.0.14; 7.2.0 before 7.2.7; 7.4.0 |
| CVE-2024-40592 | 6.7 | Nov 12 | An improper verification of cryptographic signature vulnerability [CWE-347] in FortiClient MacOS version 7.4.0, version 7.2.4 and below, version 7.0.10 and below, version 6.4.10… Affected: 6.4.0 before 7.2.5; 7.4.0 |
| CVE-2024-54019 | 6.5 | Jun 10 | A improper validation of certificate with host mismatch in Fortinet FortiClientWindows version 7.4.0, versions 7.2.0 through 7.2.6, and 7.0 all versions allow an unauthorized… Affected: 7.0.0 before 7.2.7; 7.4.0 |
| CVE-2019-17652 | 6.5 | Feb 6 | A stack buffer overflow vulnerability in FortiClient for Linux 6.2.1 and below may allow a user with low privilege to cause FortiClient processes running under root priviledge… Affected: through 6.2.1 |
| CVE-2019-16152 | 6.5 | Feb 6 | A Denial of service (DoS) vulnerability in FortiClient for Linux 6.2.1 and below may allow an user with low privilege to cause FortiClient processes running under root privilege… Affected: through 6.2.1 |
| CVE-2022-45856 | 5.9 | Sep 10 | An improper certificate validation vulnerability [CWE-295] in FortiClientWindows 6.4 all versions, 7.0.0 through 7.0.7, FortiClientMac 6.4 all versions, 7.0 all versions, 7.2.0… Affected: 5.0 before 7.2.1; 6.4 before 7.2.5; 6.4 before 7.2.5; 6.4 before 7.0.8; 2.0 before 7.0.7 |
| CVE-2018-9195 | 5.9 | Nov 21 | Use of a hardcoded cryptographic key in the FortiGuard services communication protocol may allow a Man in the middle with knowledge of the key to eavesdrop on and modify… Affected: through 6.0.6; through 6.2.1 |
| CVE-2026-44278 | 5.5 | May 12 | A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.2, FortiClientWindows 7.2 all versions may allow attacker to information… Affected: 7.2.0 before 7.4.3 |
| CVE-2025-54660 | 5.5 | Nov 18 | An active debug code vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through 7.2.10, FortiClientWindows 7.0 all versions may allow a… Affected: 7.0.0 before 7.2.11; 7.4.0 before 7.4.4 |
| CVE-2023-33304 | 5.5 | Nov 14 | A use of hard-coded credentials vulnerability in Fortinet FortiClient Windows 7.0.0 - 7.0.9 and 7.2.0 - 7.2.1 allows an attacker to bypass system protections via the use of static… Affected: 7.0.0 through 7.0.9; 7.2.0; 7.2.1 |
| CVE-2022-33877 | 5.5 | Jun 13 | An incorrect default permission [CWE-276] vulnerability in FortiClient (Windows) versions 7.0.0 through 7.0.6 and 6.4.0 through 6.4.8 and FortiConverter (Windows) versions 6.2.0… Affected: 6.4.0 through 6.4.8; 7.0.0 through 7.0.6 |
| CVE-2022-33878 | 5.5 | Nov 2 | An exposure of sensitive information to an unauthorized actor vulnerabiltiy [CWE-200] in FortiClient for Mac versions 7.0.0 through 7.0.5 may allow a local authenticated attacker… Affected: 7.0.0 through 7.0.5 |
| CVE-2019-16150 | 5.5 | Jun 4 | Use of a hard-coded cryptographic key to encrypt security sensitive data in local storage and configuration in FortiClient for Windows prior to 6.4.0 may allow an attacker with… Affected: before 6.4.0 |
| CVE-2019-15704 | 5.5 | Nov 21 | A clear text storage of sensitive information vulnerability in FortiClient for Mac may allow a local attacker to read sensitive information logged in the console window when the… Affected: 6.0.0 through 6.0.7; 6.2.0 |
| CVE-2018-9190 | 5.5 | Feb 8 | A null pointer dereference vulnerability in Fortinet FortiClientWindows 6.0.2 and earlier allows attacker to cause a denial of service via the NDIS miniport driver Affected: through 6.0.2 |
| CVE-2021-43205 | 5.3 | Apr 6 | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClient for Linux version 7.0.2 and below, 6.4.7 and below and 6.2.9 and below may… Affected: 6.2.0 through 6.2.4; 6.2.6 through 6.2.9; 6.4.0 through 6.4.4; 7.0.0 through 7.0.2; 6.4.7 |
| CVE-2021-36167 | 5.3 | Dec 9 | An improper authorization vulnerabiltiy [CWE-285] in FortiClient Windows versions 7.0.0 and 6.4.6 and below and 6.2.8 and below may allow an unauthenticated attacker to bypass the… Affected: 6.4.0 through 6.4.6; 6.2.7; 7.0.0 |
| CVE-2024-50570 | 5.0 | Dec 18 | A Cleartext Storage of Sensitive Information vulnerability [CWE-312] in FortiClientWindows 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13 and FortiClientLinux… Affected: 7.0.0 before 7.0.14; 7.0.0 before 7.2.8; 7.2.0 before 7.2.7; 7.4.0 before 7.4.2; 7.4.0 before 7.4.3 |
| CVE-2021-42754 | 5.0 | Nov 2 | An improper control of generation of code vulnerability [CWE-94] in FortiClientMacOS versions 7.0.0 and below and 6.4.5 and below may allow an authenticated attacker to hijack the… Affected: 6.4.0 through 6.4.5; 7.0.0 |
| CVE-2024-35282 | 4.6 | Sep 10 | A cleartext storage of sensitive information in memory vulnerability [CWE-316] affecting FortiClient VPN iOS 7.2 all versions, 7.0 all versions, 6.4 all versions, 6.2 all… Affected: 6.0.0 through 7.2.5 |
| CVE-2021-43204 | 4.4 | Dec 9 | A improper control of a resource through its lifetime in Fortinet FortiClientWindows version 6.4.1 and 6.4.0, version 6.2.9 and below, version 6.0.10 and below allows attacker to… Affected: 5.0.0 through 5.0.11; 5.4.0 through 5.4.5; 5.6.0 through 5.6.6; 6.0.0 through 6.0.10; 6.2.0 through 6.2.9; 4.0.1; +30 more |
| CVE-2025-24473 | 3.7 | May 28 | A exposure of sensitive system information to an unauthorized control sphere vulnerability in Fortinet FortiClientWindows 7.2.0 through 7.2.1, FortiClientWindows 7.0.13 through… Affected: 7.2.0 before 7.2.2 |
| CVE-2024-50564 | 3.3 | Jan 14 | A use of hard-coded cryptographic key in Fortinet FortiClientWindows version 7.4.0, 7.2.x all versions, 7.0.x all versions, and 6.4.x all versions may allow a low-privileged user… Affected: 6.4.0 before 7.2.9; 7.4.0 |
| CVE-2023-37939 | 3.3 | Oct 10 | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClient for Windows 7.2.0, 7.0 all versions, 6.4 all versions, 6.2 all versions, Linux… Affected: 6.2.0 through 6.2.9; 6.2.0 through 6.2.9; 6.2.0 through 6.2.9; 6.4.0 through 6.4.9; 6.4.0 through 6.4.10; 6.4.0 through 6.4.10; +7 more |
| CVE-2015-5737 | – | Sep 3 | The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, (4) mdare64_52.sys, and (5) Fortishield.sys drivers in Fortinet FortiClient before 5.2.4 do not properly restrict… Affected: through 5.2.3 |
| CVE-2015-5736 | – | Sep 3 | The Fortishield.sys driver in Fortinet FortiClient before 5.2.4 allows local users to execute arbitrary code with kernel privileges by setting the callback function in a (1)… Affected: through 5.2.3 |
| CVE-2015-5735 | – | Sep 3 | The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, and (4) mdare64_52.sys drivers in Fortinet FortiClient before 5.2.4 allow local users to write to arbitrary memory… Affected: through 5.2.3 |
| CVE-2015-4077 | – | Sep 3 | The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, and (4) mdare64_52.sys drivers in Fortinet FortiClient before 5.2.4 allow local users to read arbitrary kernel… Affected: through 5.2.3 |
| CVE-2015-1570 | – | Feb 10 | The Endpoint Control protocol implementation in Fortinet FortiClient 5.2.3.091 for Android and 5.2.028 for iOS does not validate certificates, which makes it easier for… Affected: 5.2.3.091; 5.2.028 |
| CVE-2015-1569 | – | Feb 10 | Fortinet FortiClient 5.2.028 for iOS does not validate certificates, which makes it easier for man-in-the-middle attackers to spoof SSL VPN servers via a crafted certificate Affected: 5.2.028 |
| CVE-2015-1453 | – | Feb 2 | The qm class in Fortinet FortiClient 5.2.3.091 for Android uses a hardcoded encryption key of FoRtInEt!AnDrOiD, which makes it easier for attackers to obtain passwords and… Affected: through 5.2.3.091 |
| CVE-2013-4669 | – | Jun 25 | FortiClient before 4.3.5.472 on Windows, before 4.0.3.134 on Mac OS X, and before 4.0 on Android; FortiClient Lite before 4.3.4.461 on Windows; FortiClient Lite 2.0 through… Affected: through 4.3.3.445; through 4.0.2 |
| CVE-2009-1262 | – | Apr 7 | Format string vulnerability in Fortinet FortiClient 3.0.614, and possibly earlier, allows local users to execute arbitrary code via format string specifiers in the VPN connection… Affected: 3.0.614 |