FO
Network Security
FortiManager
On CISA KEVExploited in the wild
118
CVEs
2
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 14High 40Medium 57Low 6
Watch
Add FortiManager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-33501 | 6.7 | Mar 11 | Two improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in Fortinet FortiAnalyzer version 7.4.0 through 7.4.2 and before… Affected: 6.0.10 through 6.0.12; 6.2.8 before 7.2.6; 7.4.0 before 7.4.3 |
| CVE-2024-32123 | 6.7 | Mar 11 | Multiple improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiManager, FortiAnalyzer versions 7.4.0 through 7.4.2 7.2.0… Affected: 4.3.4 before 7.2.6; 7.4.0 before 7.4.4 |
| CVE-2024-32118 | 6.7 | Nov 12 | Multiple improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilities [CWE-78] in Fortinet FortiManager version 7.4.0 through 7.4.2… Affected: 6.2.0 before 7.2.6; 7.4.0 before 7.4.3 |
| CVE-2024-31496 | 6.7 | Nov 12 | A stack-based buffer overflow vulnerability [CWE-121] in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5, FortiAnalyzer version 7.4.0 through 7.4.2 and before… Affected: 6.2.0 before 7.2.6; 7.4.0 before 7.4.3 |
| CVE-2023-47542 | 6.7 | Apr 9 | A improper neutralization of special elements used in a template engine [CWE-1336] in FortiManager versions 7.4.1 and below, versions 7.2.4 and below, and 7.0.10 and below allows… Affected: 7.0.0 before 7.0.11; 7.2.0 before 7.2.5; 7.4.0 before 7.4.2 |
| CVE-2023-41842 | 6.7 | Mar 12 | A use of externally-controlled format string vulnerability [CWE-134] vulnerability in Fortinet allows a privileged attacker to execute unauthorized code or commands via specially… Affected: 6.2.0 before 7.0.10; 7.2.0 before 7.2.4; 7.4.0 before 7.4.2 |
| CVE-2023-42788 | 6.7 | Oct 10 | An improper neutralization of special elements used in an os command ('OS Command Injection') vulnerability [CWE-78] in FortiManager & FortiAnalyzer version 7.4.0, version 7.2.0… Affected: 6.2.0 through 6.2.11; 6.4.0 through 6.4.12; 7.0.0 through 7.0.8; 7.2.0 through 7.2.3; 7.4.0 |
| CVE-2021-43072 | 6.7 | Jul 18 | A buffer copy without checking size of input ('classic buffer overflow') in Fortinet FortiAnalyzer version 7.0.2 and below, version 6.4.7 and below, version 6.2.9 and below,… Affected: 5.6.0 before 6.4.8; 7.0.0 before 7.0.3 |
| CVE-2022-26118 | 6.7 | Jul 18 | A privilege chaining vulnerability [CWE-268] in FortiManager and FortiAnalyzer 6.0.x, 6.2.x, 6.4.0 through 6.4.7, 7.0.0 through 7.0.3 may allow a local and authenticated attacker… Affected: 6.0.0 through 6.0.11; 6.2.0 through 6.2.9; 6.4.0 before 6.4.8; 7.0.0 before 7.0.4 |
| CVE-2021-42757 | 6.7 | Dec 8 | A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to achieve arbitrary code… Affected: 6.0.0 through 6.4.7; 7.0.0 through 7.0.2 |
| CVE-2026-23706 | 6.5 | Oct 13 | An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2,… Affected: 7.6.0 through 7.6.2; 7.4.0 through 7.4.6 |
| CVE-2025-68649 | 6.5 | Apr 14 | An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7,… Affected: 7.6.0 through 7.6.4; 7.4.0 through 7.4.7; 7.2.0 through 7.2.12; 7.0.0 through 7.0.16 |
| CVE-2024-52964 | 6.5 | Aug 12 | An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiManager version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5,… Affected: 6.2.0 before 7.0.14; 7.2.0 before 7.2.10; 7.4.0 before 7.4.6; 7.6.0 before 7.6.2 |
| CVE-2024-40585 | 6.5 | Mar 14 | An insertion of sensitive information into log file vulnerabilities [CWE-532] in FortiManager version 7.4.0, version 7.2.3 and below, version 7.0.8 and below, version 6.4.12 and… Affected: 6.2.0 before 7.0.9; 7.2.0 before 7.2.4; 7.4.0 |
| CVE-2023-44254 | 6.5 | Sep 10 | An authorization bypass through user-controlled key [CWE-639] vulnerability in FortiAnalyzer version 7.4.1 and before 7.2.5 and FortiManager version 7.4.1 and before 7.2.5 may… Affected: 7.4.0; 7.2.0 through 7.2.4; 7.0.0 through 7.0.12; 6.4.0 through 6.4.14; 6.2.0 through 6.2.12 |
| CVE-2023-44256 | 6.5 | Oct 20 | A server-side request forgery vulnerability [CWE-918] in Fortinet FortiAnalyzer version 7.4.0, version 7.2.0 through 7.2.3 and before 7.0.8 and FortiManager version 7.4.0, version… Affected: 7.0.0 through 7.0.8; 7.2.0 through 7.2.3; 7.4.0 |
| CVE-2023-44249 | 6.5 | Oct 10 | An authorization bypass through user-controlled key [CWE-639] vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiAnalyzer version 7.4.0 and before… Affected: 6.2.0 through 6.2.12; 6.4.0 through 6.4.13; 7.0.0 through 7.0.9; 7.2.0 before 7.2.4; 7.4.0 |
| CVE-2023-42787 | 6.5 | Oct 10 | A client-side enforcement of server-side security [CWE-602] vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiAnalyzer version 7.4.0 and before 7.2.3… Affected: 6.2.0 through 6.2.12; 6.4.0 through 6.4.13; 7.0.0 through 7.0.9; 7.2.0 through 7.2.3; 7.4.0 |
| CVE-2023-25606 | 6.5 | Jul 11 | An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-23] in FortiAnalyzer and FortiManager management interface 7.2.0 through… Affected: 6.4.0 before 6.4.12; 7.0.0 through 7.0.5; 7.2.0 before 7.2.2 |
| CVE-2023-25609 | 6.5 | Jun 13 | A server-side request forgery (SSRF) vulnerability [CWE-918] in FortiManager and FortiAnalyzer GUI 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.8 through 6.4.11 may allow a… Affected: 6.4.8 through 6.4.11; 7.0.0 through 7.0.6; 7.2.0; 7.2.1 |
| CVE-2022-27490 | 6.5 | Mar 7 | A exposure of sensitive information to an unauthorized actor in Fortinet FortiManager version 6.0.0 through 6.0.4, FortiAnalyzer version 6.0.0 through 6.0.4, FortiPortal version… Affected: 5.6.0 through 5.6.11; 6.0.0 through 6.0.4 |
| CVE-2021-32603 | 6.5 | Aug 5 | A server-side request forgery (SSRF) (CWE-918) vulnerability in FortiManager and FortiAnalyser GUI 7.0.0, 6.4.5 and below, 6.2.7 and below, 6.0.11 and below, 5.6.11 and below may… Affected: 5.6.0 before 6.2.8; 6.4.0 before 6.4.6; 7.0.0 before 7.0.1 |
| CVE-2018-1354 | 6.5 | Jun 27 | An improper access control vulnerability in Fortinet FortiManager 6.0.0, 5.6.5 and below versions, FortiAnalyzer 6.0.0, 5.6.5 and below versions allows a regular user edit the… Affected: through 6.0.0 |
| CVE-2021-24016 | 6.3 | Sep 30 | An improper neutralization of formula elements in a csv file in Fortinet FortiManager version 6.4.3 and below, 6.2.7 and below allows attacker to execute arbitrary commands via… Affected: before 6.2.8; 6.4.0 before 6.4.4 |
| CVE-2026-106171 | 6.1 | Oct 13 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.6,… Affected: 8.0.0; 7.6.0 through 7.6.6 |
| CVE-2020-12811 | 6.1 | Sep 24 | A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network… Affected: 6.2.5; 6.2.0 through 6.2.3 |
| CVE-2018-13375 | 6.1 | May 28 | An Improper Neutralization of Script-Related HTML Tags in Fortinet FortiAnalyzer 5.6.0 and below and FortiManager 5.6.0 and below allows an attacker to send DHCP request… Affected: through 5.6.0 |
| CVE-2018-1355 | 6.1 | Jun 27 | An open redirect vulnerability in Fortinet FortiManager 6.0.0, 5.6.5 and below versions, FortiAnalyzer 6.0.0, 5.6.5 and below versions allows attacker to inject script code during… Affected: through 5.6.5; 6.0.0 |
| CVE-2024-36508 | 6.0 | Feb 11 | An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5 and… Affected: 6.4.0 before 7.2.6; 7.4.0 before 7.4.3 |
| CVE-2024-32116 | 6.0 | Nov 12 | Multiple relative path traversal vulnerabilities [CWE-23] in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5, FortiAnalyzer version 7.4.0 through 7.4.2 and… Affected: 6.2.0 before 7.2.6; 7.4.0 before 7.4.3 |
| CVE-2025-68482 | 5.9 | Mar 10 | A improper certificate validation vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.8, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0… Affected: 6.4.0 before 7.4.9; 7.6.0 before 7.6.5 |
| CVE-2024-32115 | 5.5 | Jan 14 | A relative path traversal vulnerability [CWE-23] in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5 allows a privileged attacker to delete files from the… Affected: 7.0.0 before 7.2.6; 7.4.0 before 7.4.3 |
| CVE-2023-40719 | 5.5 | Nov 14 | A use of hard-coded credentials vulnerability in Fortinet FortiAnalyzer and FortiManager 7.0.0 - 7.0.8, 7.2.0 - 7.2.3 and 7.4.0 allows an attacker to access Fortinet private… Affected: 7.0.0 through 7.0.10; 7.2.0 through 7.2.3; 7.4.0 |
| CVE-2022-22303 | 5.5 | Mar 2 | An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiManager versions prior to 7.0.2, 6.4.7 and 6.2.9 may allow a low… Affected: 6.2.0 through 6.2.9; 6.4.0 through 6.4.7; 7.0.0 through 7.0.2 |
| CVE-2022-39950 | 5.4 | Nov 2 | An improper neutralization of input during web page generation vulnerability [CWE-79] exists in FortiManager and FortiAnalyzer 6.0.0 all versions, 6.2.0 all versions, 6.4.0… Affected: 6.0.0 through 6.2.9; 6.4.0 through 6.4.8; 7.0.0 through 7.0.4 |
| CVE-2021-32597 | 5.4 | Aug 6 | Multiple improper neutralization of input during web page generation (CWE-79) in FortiManager and FortiAnalyzer versions 7.0.0, 6.4.5 and below, 6.2.7 and below user interface,… Affected: before 6.2.8; 6.4.0 before 6.4.6; 7.0.0 before 7.0.1 |
| CVE-2015-3612 | 5.4 | Feb 4 | A Cross-site Scripting (XSS) vulnerability exists in FortiManager 5.2.1 and earlier and 5.0.10 and earlier via an unspecified parameter in the FortiWeb auto update service page Affected: 5.0.0 through 5.0.10; 5.2.0 through 5.2.1 |
| CVE-2025-67604 | 5.3 | May 12 | A use of potentially dangerous function vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.8, FortiAnalyzer 7.2 all versions,… Affected: 7.6.0 through 7.6.4; 7.4.0 through 7.4.8; 7.2.0 through 7.2.12; 7.0.0 through 7.0.16; 6.4.0 through 6.4.15 |
| CVE-2024-52962 | 5.3 | Apr 8 | An Improper Output Neutralization for Logs vulnerability [CWE-117] in FortiAnalyzer version 7.6.1 and below, version 7.4.5 and below, version 7.2.8 and below, version 7.0.13 and… Affected: 7.0.0 before 7.0.14; 7.2.0 before 7.2.9; 7.4.0 before 7.4.6; 7.6.0 before 7.6.2 |
| CVE-2022-26121 | 5.3 | Oct 10 | An exposure of resource to wrong sphere vulnerability [CWE-668] in FortiAnalyzer and FortiManager GUI 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.0 through 6.2.9, 6.0.0 through… Affected: after 5.6.0 through 5.6.11; after 6.0.0 through 6.0.11; after 6.2.0 through 6.2.9; after 6.4.0 through 6.4.8; after 7.0.0 through 7.0.3 |
| CVE-2023-44253 | 5.0 | Feb 15 | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in Fortinet FortiManager version 7.4.0 through 7.4.1 and before 7.2.5, FortiAnalyzer version… Affected: 6.2.0 through 6.2.12; 6.4.0 through 6.4.14; 7.0.0 through 7.0.11; 7.2.0 through 7.2.3; 7.4.0; 7.4.1 |
| CVE-2026-22575 | 4.9 | Sep 8 | An improper access control vulnerability in Fortinet FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.10, FortiManager 7.2 all versions, FortiManager Cloud 7.6.2… Affected: 7.6.0 through 7.6.4; 7.4.0 through 7.4.10; 7.2.0 through 7.2.12; 7.0.0 through 7.0.16; 6.4.0 through 6.4.15 |
| CVE-2024-32117 | 4.9 | Nov 12 | An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiManager version 7.4.0 through 7.4.2 and below 7.2.5,… Affected: 6.2.0 before 7.2.6; 7.4.0 before 7.4.3 |
| CVE-2018-1351 | 4.8 | Jun 28 | A Cross-site Scripting (XSS) vulnerability in Fortinet FortiManager 6.0.0, 5.6.6 and below versions allows attacker to execute HTML/javascript code via managed remote devices CLI… Affected: through 6.0.0 |
| CVE-2024-40593 | 4.4 | Dec 11 | A key management errors vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.2, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all… Affected: 6.4.0 before 7.2.6; 7.4.0 before 7.4.3 |
| CVE-2021-24022 | 4.4 | Jul 20 | A buffer overflow vulnerability in FortiAnalyzer CLI 6.4.5 and below, 6.2.7 and below, 6.0.x and FortiManager CLI 6.4.5 and below, 6.2.7 and below, 6.0.x may allow an… Affected: 6.0.0 before 6.2.8; 6.4.0 before 6.4.6 |
| CVE-2024-47569 | 4.3 | Oct 14 | A insertion of sensitive information into sent data vulnerability in Fortinet FortiMail 7.4.0 through 7.4.2, FortiMail 7.2.0 through 7.2.6, FortiMail 7.0 all versions,… Affected: 7.6.0 through 7.6.1; 7.4.1 through 7.4.3 |
| CVE-2024-54020 | 4.3 | May 28 | A missing authorization in Fortinet FortiManager versions 7.2.0 through 7.2.1, and versions 7.0.0 through 7.0.7 may allow an authenticated attacker to overwrite global threat… Affected: 7.0.0 before 7.0.8; 7.2.0 before 7.2.2 |
| CVE-2024-33506 | 4.3 | Oct 8 | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiManager 7.4.2 and below, 7.2.5 and below, 7.0.12 and below allows a remote… Affected: 7.0.0 before 7.2.6; 7.4.0 before 7.4.3 |
| CVE-2023-36638 | 4.3 | Sep 13 | An improper privilege management vulnerability [CWE-269] in FortiManager 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions and… Affected: 6.4.0 before 6.4.12; 7.0.0 before 7.0.8; 7.2.0 before 7.2.3 |