FO
Network Security
FortiManager
On CISA KEVExploited in the wild
118
CVEs
2
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 14High 40Medium 57Low 6
Watch
Add FortiManager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-47569 | 4.3 | Oct 14 | A insertion of sensitive information into sent data vulnerability in Fortinet FortiMail 7.4.0 through 7.4.2, FortiMail 7.2.0 through 7.2.6, FortiMail 7.0 all versions,… Affected: 7.6.0 through 7.6.1; 7.4.1 through 7.4.3 |
| CVE-2024-54020 | 4.3 | May 28 | A missing authorization in Fortinet FortiManager versions 7.2.0 through 7.2.1, and versions 7.0.0 through 7.0.7 may allow an authenticated attacker to overwrite global threat… Affected: 7.0.0 before 7.0.8; 7.2.0 before 7.2.2 |
| CVE-2024-33506 | 4.3 | Oct 8 | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiManager 7.4.2 and below, 7.2.5 and below, 7.0.12 and below allows a remote… Affected: 7.0.0 before 7.2.6; 7.4.0 before 7.4.3 |
| CVE-2023-36638 | 4.3 | Sep 13 | An improper privilege management vulnerability [CWE-269] in FortiManager 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions and… Affected: 6.4.0 before 6.4.12; 7.0.0 before 7.0.8; 7.2.0 before 7.2.3 |
| CVE-2021-26107 | 4.3 | Nov 2 | An improper access control vulnerability [CWE-284] in FortiManager versions 6.4.4 and 6.4.5 may allow an authenticated attacker with a restricted user profile to modify the VPN… Affected: 6.4.4; 6.4.5 |
| CVE-2021-24017 | 4.3 | Sep 30 | An improper authentication in Fortinet FortiManager version 6.4.3 and below, 6.2.6 and below allows attacker to assign arbitrary Policy and Object modules via crafted requests to… Affected: before 6.2.7; 6.4.0 before 6.4.4 |
| CVE-2021-32587 | 4.3 | Aug 6 | An improper access control vulnerability in FortiManager and FortiAnalyzer GUI interface 7.0.0, 6.4.5 and below, 6.2.8 and below, 6.0.11 and below, 5.6.11 and below may allow a… Affected: 5.6.0 before 6.4.6; 7.0.0 before 7.0.1 |
| CVE-2021-32598 | 4.3 | Aug 5 | An improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting') vulnerability In FortiManager and FortiAnalyzer GUI 7.0.0, 6.4.6 and below, 6.2.8 and… Affected: 5.6.0 before 7.0.1 |
| CVE-2018-1353 | 4.3 | Sep 5 | An information disclosure vulnerability in Fortinet FortiManager 6.0.1 and below versions allows a standard user with adom assignment read the interface settings of vdoms… Affected: through 6.0.1 |
| CVE-2022-22305 | 4.2 | Sep 1 | An improper certificate validation vulnerability [CWE-295] in FortiManager 7.0.1 and below, 6.4.6 and below; FortiAnalyzer 7.0.2 and below, 6.4.7 and below; FortiOS 6.2.x and… Affected: 6.0.0 through 6.0.12; 6.2.0 through 6.2.11; 6.4.0 through 6.4.6; 7.0.0; 7.0.1 |
| CVE-2023-44255 | 4.1 | Nov 12 | An exposure of sensitive information to an unauthorized actor [CWE-200] in Fortinet FortiManager before 7.4.2, FortiAnalyzer before 7.4.2 and FortiAnalyzer-BigData before 7.2.5… Affected: 6.2.0 before 7.4.3 |
| CVE-2021-36192 | 3.8 | Nov 3 | An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in FortiManager 7.0.1 and below, 6.4.6 and below, 6.2.x, 6.0.x, 5.6.0 may allow a FortiGate… Affected: 5.6.0 through 5.6.11; 6.0.0 through 6.0.11; 6.2.0 through 6.2.8; 6.4.0 before 6.4.6; 7.0.0 before 7.0.1 |
| CVE-2026-22629 | 3.7 | Mar 10 | An improper restriction of excessive authentication attempts vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4 all versions, FortiAnalyzer 7.2 all… Affected: 6.4.0 before 7.6.5 |
| CVE-2021-36170 | 3.2 | Oct 6 | An information disclosure vulnerability [CWE-200] in FortiAnalyzerVM and FortiManagerVM versions 7.0.0 and 6.4.6 and below may allow an authenticated attacker to read the… Affected: before 6.4.7; 7.0.0 before 7.0.1 |
| CVE-2025-24474 | 2.7 | Jul 8 | An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiManager 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, 7.2 all… Affected: 6.4.0 before 7.4.7; 7.6.0 before 7.6.2 |
| CVE-2022-38377 | 2.7 | Nov 25 | An improper access control vulnerability [CWE-284] in FortiManager 7.2.0, 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2.0 through 6.2.9, 6.0.0 through 6.0.11 and FortiAnalyzer… Affected: 6.0.0 through 6.0.11; 6.2.0 through 6.2.9; 6.4.0 through 6.4.7; 7.0.0 through 7.0.3; 7.2.0 |
| CVE-2024-35274 | 2.3 | Nov 12 | An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiAnalyzer versions below 7.4.2, Fortinet FortiManager… Affected: 6.2.0 before 7.4.3 |
| CVE-2014-2336 | – | Oct 31 | Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 and FortiAnalyzer before 5.0.7 allow remote attackers to inject… Affected: through 5.0.6 |