FortiManager vulnerabilities | LiveThreat CVE Feed

Network Security

FortiManager

by Fortinet · last CVE Oct 13, 2026

On CISA KEVExploited in the wild

118

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities118 In the news3 Timeline

Severity mix

Critical 14High 40Medium 57Low 6

Severity

All severities118 Critical14 High40 Medium57 Low6

Exploitation

On CISA KEV2 Exploited in the wild2

Watch

Add FortiManager to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2021-26107	4.3	1%	Nov 2	An improper access control vulnerability [CWE-284] in FortiManager versions 6.4.4 and 6.4.5 may allow an authenticated attacker with a restricted user profile to modify the VPN… Affected: 6.4.4; 6.4.5
CVE-2021-24017	4.3	1%	Sep 30	An improper authentication in Fortinet FortiManager version 6.4.3 and below, 6.2.6 and below allows attacker to assign arbitrary Policy and Object modules via crafted requests to… Affected: before 6.2.7; 6.4.0 before 6.4.4
CVE-2021-32587	4.3	1%	Aug 6	An improper access control vulnerability in FortiManager and FortiAnalyzer GUI interface 7.0.0, 6.4.5 and below, 6.2.8 and below, 6.0.11 and below, 5.6.11 and below may allow a… Affected: 5.6.0 before 6.4.6; 7.0.0 before 7.0.1
CVE-2021-32598	4.3	1%	Aug 5	An improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting') vulnerability In FortiManager and FortiAnalyzer GUI 7.0.0, 6.4.6 and below, 6.2.8 and… Affected: 5.6.0 before 7.0.1
CVE-2018-1353	4.3	1%	Sep 5	An information disclosure vulnerability in Fortinet FortiManager 6.0.1 and below versions allows a standard user with adom assignment read the interface settings of vdoms… Affected: through 6.0.1
CVE-2022-22305	4.2	0%	Sep 1	An improper certificate validation vulnerability [CWE-295] in FortiManager 7.0.1 and below, 6.4.6 and below; FortiAnalyzer 7.0.2 and below, 6.4.7 and below; FortiOS 6.2.x and… Affected: 6.0.0 through 6.0.12; 6.2.0 through 6.2.11; 6.4.0 through 6.4.6; 7.0.0; 7.0.1
CVE-2023-44255	4.1	1%	Nov 12	An exposure of sensitive information to an unauthorized actor [CWE-200] in Fortinet FortiManager before 7.4.2, FortiAnalyzer before 7.4.2 and FortiAnalyzer-BigData before 7.2.5… Affected: 6.2.0 before 7.4.3