FO
Network Security
FortiOS
On CISA KEVExploited in the wildRansomware-linked
282
CVEs
21
On KEV
9.8
Max CVSS
2
New 30D
Severity mix
Critical 23High 86Medium 146Low 10
Watch
Add FortiOS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-24858 In wildKEV | 9.8 | Jan 27 | Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability Affected: 7.6.0 through 7.6.5; 7.4.0 through 7.4.10; 7.2.0 through 7.2.12; 7.0.0 through 7.0.18 |
| CVE-2025-25249 In wildKEV | 9.8 | Jan 13 | Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability Affected: 7.6.0 through 7.6.2; 7.4.0 through 7.4.7; 7.2.4 through 7.2.11 |
| CVE-2025-59718 In wildKEV | 9.8 | Dec 9 | Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability Affected: 7.6.0 through 7.6.3; 7.4.0 through 7.4.8; 7.2.0 through 7.2.11; 7.0.0 through 7.0.17 |
| CVE-2024-55591 RansomwareIn wildKEV | 9.8 | Jan 14 | Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability Affected: 7.0.0 through 7.0.16 |
| CVE-2024-23113 In wildKEV | 9.8 | Feb 15 | Fortinet Multiple Products Format String Vulnerability Affected: 7.4.0 through 7.4.2; 7.2.0 through 7.2.6; 7.0.0 through 7.0.13 |
| CVE-2024-21762 RansomwareIn wildKEV | 9.8 | Feb 9 | Fortinet FortiOS Out-of-Bound Write Vulnerability Affected: 7.4.0 through 7.4.2; 7.2.0 through 7.2.6; 7.0.0 through 7.0.13; 6.4.0 through 6.4.14; 6.2.0 through 6.2.15; 6.0.0 through 6.0.18 |
| CVE-2023-27997 RansomwareIn wildKEV | 9.8 | Jun 13 | Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability Affected: 7.2.0 through 7.2.4; 7.0.0 through 7.0.11; 6.4.0 through 6.4.12; 6.2.0 through 6.2.13; 6.0.0 through 6.0.16 |
| CVE-2022-42475 RansomwareIn wildKEV | 9.8 | Jan 2 | Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability Affected: 7.2.0 through 7.2.2; 7.0.0 through 7.0.8; 6.4.0 through 6.4.10; 6.2.0 through 6.2.11; 6.0.0 through 6.0.15; 5.6.0 through 5.6.14; +3 more |
| CVE-2022-40684 RansomwareIn wildKEV | 9.8 | Oct 18 | Fortinet Multiple Products Authentication Bypass Vulnerability Affected: 7.0.0 before 7.0.7; 7.2.0 before 7.2.2 |
| CVE-2020-12812 RansomwareIn wildKEV | 9.8 | Jul 24 | Fortinet FortiOS SSL VPN Improper Authentication Vulnerability Affected: FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below |
| CVE-2018-13379 RansomwareIn wildKEV | 9.8 | Jun 4 | Fortinet FortiOS SSL VPN Path Traversal Vulnerability Affected: 5.4.6 before 5.4.13; 5.6.3 before 5.6.8; 6.0.0 before 6.0.5 |
| CVE-2025-24472 RansomwareIn wildKEV | 8.1 | Feb 11 | Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability Affected: 7.0.0 through 7.0.16 |
| CVE-2021-44168 In wildKEV | 7.8 | Jan 4 | Fortinet FortiOS Arbitrary File Download Affected: FortiOS before 7.0.3 |
| CVE-2018-13382 RansomwareIn wildKEV | 7.5 | Jun 4 | Fortinet FortiOS and FortiProxy Improper Authorization Affected: 5.4.1 before 5.4.11; 5.6.0 before 5.6.9; 6.0.0 before 6.0.5 |
| CVE-2022-41328 In wildKEV | 7.1 | Mar 7 | Fortinet FortiOS Path Traversal Vulnerability Affected: 7.2.0 through 7.2.3; 7.0.0 through 7.0.9; 6.4.0 through 6.4.11; 6.2.0 through 6.2.13; 6.0.0 through 6.0.16 |
| CVE-2025-61624 In wildKEV | 6.5 | Apr 14 | Fortinet Multiple Products Path Traversal Vulnerability Affected: 7.6.0 through 7.6.4; 7.4.0 through 7.4.9; 7.2.0 through 7.2.13; 7.0.0 through 7.0.19; 6.4.0 through 6.4.16 |
| CVE-2019-5591 RansomwareIn wildKEV | 6.5 | Aug 14 | Fortinet FortiOS Default Configuration Vulnerability Affected: FortiOS 6.2.0 and below. |
| CVE-2019-6693 RansomwareIn wildKEV | 6.5 | Nov 21 | Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability Affected: 5.6.9 and below; 6.0.5 and below; 6.2.0 |
| CVE-2018-13383 RansomwareIn wildKEV | 6.5 | May 29 | Fortinet FortiOS and FortiProxy Out-of-bounds Write Affected: 5.2.0 before 5.2.15; 5.4.0 before 5.4.13; 5.6.0 before 5.6.11; 6.0.0 before 6.0.5 |
| CVE-2025-68686 In wildKEV | 5.9 | Feb 10 | Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability Affected: 7.6.0 through 7.6.1; 7.4.0 through 7.4.6; 7.2.0 through 7.2.13; 7.0.0 through 7.0.19; 6.4.0 through 6.4.16 |
| CVE-2018-13374 RansomwareIn wildKEV | 4.3 | Jan 22 | Fortinet FortiOS and FortiADC Improper Access Control Vulnerability Affected: before 6.0.3 |
| CVE-2023-25610 | 9.8 | Mar 24 | A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.6, version 6.4.0… Affected: 5.0.0 before 6.2.13; 6.4.0 before 6.4.12; 7.0.0 before 7.0.10; 7.2.0 before 7.2.4 |
| CVE-2024-48886 | 9.8 | Jan 14 | A weak authentication in Fortinet FortiOS versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, FortiProxy versions 7.4.0 through 7.4.4,… Affected: 6.4.0 before 7.0.16; 7.2.0 before 7.2.9; 7.4.0 before 7.4.5 |
| CVE-2024-26011 | 9.8 | Nov 12 | A missing authentication for critical function vulnerability in Fortinet FortiManager 7.4.0 through 7.4.2, FortiManager 7.2.0 through 7.2.4, FortiManager 7.0.0 through 7.0.11,… Affected: 7.4.0 through 7.4.3; 7.2.0 through 7.2.7; 7.0.0 through 7.0.14; 6.4.0 through 6.4.16; 6.2.0 through 6.2.17; 6.0.0 through 6.0.18 |
| CVE-2023-42789 | 9.8 | Mar 12 | A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0… Affected: 6.2.0 through 6.2.15; 6.4.0 through 6.4.14; 7.0.0 through 7.0.12; 7.2.0 through 7.2.5; 7.4.0; 7.4.1 |
| CVE-2023-33308 | 9.8 | Jul 26 | A stack-based overflow vulnerability [CWE-124] in Fortinet FortiOS version 7.0.0 through 7.0.10 and 7.2.0 through 7.2.3 and FortiProxy version 7.0.0 through 7.0.9 and 7.2.0… Affected: 7.0.0 through 7.0.10; 7.2.0 through 7.2.3 |
| CVE-2023-28001 | 9.8 | Jul 11 | An insufficient session expiration in Fortinet FortiOS 7.0.0 - 7.0.12 and 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or commands via reusing the session of a… Affected: 7.0.0 through 7.0.12; 7.2.0 through 7.2.4 |
| CVE-2022-35843 | 9.8 | Dec 6 | An authentication bypass by assumed-immutable data vulnerability [CWE-302] in the FortiOS SSH login component 7.2.0, 7.0.0 through 7.0.7, 6.4.0 through 6.4.9, 6.2 all versions,… Affected: 6.0.0 through 6.0.15; 6.2.0 through 6.2.12; 6.4.0 through 6.4.9; 7.0.0 through 7.0.7; 7.2.0; 7.2.1 |
| CVE-2021-26109 | 9.8 | Dec 8 | An integer overflow or wraparound vulnerability in the memory allocator of SSLVPN in FortiOS before 7.0.1 may allow an unauthenticated attacker to corrupt control data on the heap… Affected: 6.0.0 through 6.0.12; 6.2.0 through 6.2.9; 6.4.0 through 6.4.5; 7.0.0 |
| CVE-2018-1352 | 9.8 | Feb 8 | A format string vulnerability in Fortinet FortiOS 5.6.0 allows attacker to execute unauthorized code or commands via the SSH username variable Affected: 5.6.0 |
| CVE-2016-6909 | 9.8 | Aug 24 | Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9 and FortiSwitch before 3.4.3 allows remote attackers to… Affected: 4.1.0 before 4.1.11; 4.2.0 before 4.2.13; 4.3.0 before 4.3.9 |
| CVE-2016-1909 | 9.8 | Jan 15 | Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0.8; and FortiOS 4.1.x before 4.1.11, 4.2.x before 4.2.16,… Affected: through 4.3.16; 5.0; 5.0.0; 5.0.1; 5.0.2; 5.0.3; +4 more |
| CVE-2024-48884 | 9.1 | Jan 14 | A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.1 through 7.4.3,… Affected: 7.6.0; 7.4.0 through 7.4.4; 7.2.0 through 7.2.9; 7.0.0 through 7.0.15; 6.4.0 through 6.4.15 |
| CVE-2025-53844 | 8.8 | May 12 | A out-of-bounds write vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11 allows attacker to execute unauthorized code… Affected: 7.6.0 through 7.6.3; 7.4.0 through 7.4.8; 7.2.0 through 7.2.11; 7.0.0 through 7.0.17; 6.4.0 through 6.4.16; 6.2.0 through 6.2.17; +1 more |
| CVE-2025-53847 | 8.8 | Apr 14 | A missing authentication for critical function vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0… Affected: 6.2.9 before 7.0.18; 7.2.0 before 7.2.12; 7.4.0 before 7.4.9; 7.6.0 before 7.6.4 |
| CVE-2025-57740 | 8.8 | Oct 14 | An Heap-based Buffer Overflow vulnerability [CWE-122] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions;… Affected: 7.6.0 through 7.6.2; 7.4.0 through 7.4.7; 7.2.0 through 7.2.10; 7.0.0 through 7.0.18; 6.4.0 through 6.4.16 |
| CVE-2023-37930 | 8.8 | Apr 8 | Multiple issues including the use of uninitialized ressources [CWE-908] and excessive iteration [CWE-834] vulnerabilities vulnerability in Fortinet allows a VPN user to corrupt… Affected: 6.4.7 before 6.4.15; 7.0.1 before 7.0.13; 7.2.0 before 7.2.6; 7.4.0 |
| CVE-2020-12820 | 8.8 | Dec 19 | Under non-default configuration, a stack-based buffer overflow in FortiOS version 6.0.10 and below, version 5.6.12 and below may allow a remote attacker authenticated to the SSL… Affected: 6.0.0 through 6.0.10; 5.6.0 through 5.6.12 |
| CVE-2023-50176 | 8.8 | Nov 12 | A session fixation vulnerability in Fortinet FortiOS 7.4.0 through 7.4.3, FortiOS 7.2.0 through 7.2.7, FortiOS 7.0.0 through 7.0.13 allows attacker to execute unauthorized code or… Affected: 7.0.0 before 7.0.14; 7.2.0 before 7.2.8; 7.4.0 before 7.4.4 |
| CVE-2022-45862 | 8.8 | Aug 13 | An insufficient session expiration vulnerability [CWE-613] vulnerability in FortiOS 7.2.5 and below, 7.0 all versions, 6.4 all versions; FortiProxy 7.2 all versions, 7.0 all… Affected: 6.4.0 before 7.2.6 |
| CVE-2023-41677 | 8.8 | Apr 9 | A insufficiently protected credentials vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4.0 through… Affected: 7.4.0 through 7.4.1; 7.2.0 through 7.2.6; 7.0.0 through 7.0.12; 6.4.0 through 6.4.14; 6.2.0 through 6.2.15; 6.0.0 through 6.0.18 |
| CVE-2023-46717 | 8.8 | Mar 12 | An improper authentication vulnerability [CWE-287] in FortiOS versions 7.4.1 and below, versions 7.2.6 and below, and versions 7.0.12 and below when configured with… Affected: 7.0.0 before 7.0.13; 7.2.0 before 7.2.7; 7.4.0 before 7.4.2 |
| CVE-2023-29181 | 8.8 | Feb 22 | A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4, FortiOS 7.0.0 through 7.0.11, FortiOS 6.4.0 through 6.4.12, FortiOS 6.2.0… Affected: 7.2.0 through 7.2.4; 7.0.0 through 7.0.11; 6.4.0 through 6.4.12; 6.2.0 through 6.2.14; 6.0.0 through 6.0.16; 5.6.0 through 5.6.14; +7 more |
| CVE-2023-44250 | 8.8 | Jan 10 | An improper privilege management vulnerability [CWE-269] in a Fortinet FortiOS HA cluster version 7.4.0 through 7.4.1 and 7.2.5 and in a FortiProxy HA cluster version 7.4.0… Affected: 7.2.5; 7.4.0; 7.4.1 |
| CVE-2023-41678 | 8.8 | Dec 13 | A double free in Fortinet FortiOS versions 7.0.0 through 7.0.5, FortiPAM version 1.0.0 through 1.0.3, 1.1.0 through 1.1.1 allows attacker to execute unauthorized code or commands… Affected: 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; 7.0.5 |
| CVE-2023-36639 | 8.8 | Dec 13 | A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, FortiOS versions 7.4.0, 7.2.0 through 7.2.4, 7.0.0 through… Affected: 6.0.0 through 6.0.17; 6.2.0 through 6.2.15; 6.4.0 through 6.4.12; 7.0.0 through 7.0.11; 7.2.0 through 7.2.4; 7.4.0 |
| CVE-2023-41841 | 8.8 | Oct 10 | An improper authorization vulnerability in Fortinet FortiOS 7.0.0 - 7.0.11 and 7.2.0 - 7.2.4 allows an attacker belonging to the prof-admin profile to perform elevated actions Affected: 7.0.0 through 7.0.11; 7.2.0 through 7.2.4 |
| CVE-2023-22640 | 8.8 | May 3 | A out-of-bounds write vulnerability in Fortinet FortiOS 7.2.0 through 7.2.3, FortiOS 7.0.0 through 7.0.10, FortiOS 6.4.0 through 6.4.11, FortiOS 6.2.0 through 6.2.13, FortiOS… Affected: 7.2.0 through 7.2.3; 7.0.0 through 7.0.10; 6.4.0 through 6.4.11; 6.2.0 through 6.2.13; 6.0.0 through 6.0.16 |
| CVE-2022-43947 | 8.8 | Apr 11 | An improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiOS version 7.2.0 through 7.2.3 and before 7.0.10, FortiProxy version 7.2.0… Affected: 6.2.0 before 6.4.13; 7.0.0 before 7.0.11; 7.2.0 before 7.2.4 |
| CVE-2021-36173 | 8.8 | Dec 8 | A heap-based buffer overflow in the firmware signature verification function of FortiOS versions 7.0.1, 7.0.0, 6.4.0 through 6.4.6, 6.2.0 through 6.2.9, and 6.0.0 through 6.0.13… Affected: 6.0.0 through 6.0.13; 6.2.0 through 6.2.9; 6.4.0 through 6.4.6; 7.0.0; 7.0.1 |