FO
Product
FortiOS
On CISA KEVExploited in the wildRansomware-linked
284
CVEs
21
On KEV
9.8
Max CVSS
2
New 30D
Severity mix
Critical 23High 86Medium 147Low 11
Watch
Add FortiOS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-46666 | 5.3 | Jan 14 | An allocation of resources without limits or throttling [CWE-770] vulnerability in FortiOS versions 7.6.0, versions 7.4.4 through 7.4.0, 7.2 all versions, 7.0 all versions, 6.4… Affected: 7.6.0; 7.4.0 through 7.4.4; 7.2.0 through 7.2.10; 7.0.0 through 7.0.16; 6.4.0 through 6.4.15 |
| CVE-2023-47536 | 5.3 | Dec 13 | An improper access control vulnerability [CWE-284] in FortiOS version 7.2.0, version 7.0.13 and below, version 6.4.14 and below and FortiProxy version 7.2.3 and below, version… Affected: 7.2.0; 7.0.0 through 7.0.13; 6.4.0 through 6.4.14 |
| CVE-2023-41675 | 5.3 | Oct 10 | A use after free vulnerability [CWE-416] in FortiOS version 7.2.0 through 7.2.4 and version 7.0.0 through 7.0.10 and FortiProxy version 7.2.0 through 7.2.2 and version 7.0.0… Affected: 7.2.0 through 7.2.4; 7.0.0 through 7.0.10 |
| CVE-2022-41329 | 5.3 | Mar 7 | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in Fortinet FortiProxy version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.7, FortiOS version… Affected: 7.2.0 through 7.2.3; 7.0.0 through 7.0.9; 6.4.0 through 6.4.12; 6.2.3 through 6.2.13 |
| CVE-2022-22306 | 5.3 | May 24 | An improper certificate validation vulnerability [CWE-295] in FortiOS 6.0.0 through 6.0.14, 6.2.0 through 6.2.10, 6.4.0 through 6.4.8, 7.0.0 may allow a network adjacent and… Affected: FortiOS 6.0.0 through 6.0.14, 6.2.0 through 6.2.10, 6.4.0 through 6.4.8, 7.0.0 |
| CVE-2020-12818 | 5.3 | Sep 24 | An insufficient logging vulnerability in FortiGate before 6.4.1 may allow the traffic from an unauthenticated attacker to Fortinet owned IP addresses to go unnoticed Affected: FortiOS before 6.4.1 |
| CVE-2018-13367 | 5.3 | Aug 23 | An information exposure vulnerability in FortiOS 6.2.3, 6.2.0 and below may allow an unauthenticated attacker to gain platform information such as version, models, via parsing a… Affected: 6.2.3; 6.2.0 and below |
| CVE-2018-13365 | 5.3 | May 29 | An Information Exposure vulnerability in Fortinet FortiOS 6.0.1, 5.6.5 and below, allow attackers to learn private IP as well as the hostname of FortiGate via Application Control… Affected: 6.0.1; 5.6.5 and below |
| CVE-2018-13366 | 5.3 | Apr 9 | An information disclosure vulnerability in Fortinet FortiOS 6.0.1, 5.6.7 and below allows attacker to reveals serial number of FortiGate via hostname field defined in connection… Affected: 6.0.1; 5.6.7 and below |
| CVE-2017-14185 | 5.3 | May 25 | An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.8 and 5.2 all versions allows SSL VPN web portal users to access internal FortiOS… Affected: 5.6.0 to 5.6.2; 5.4.0 to 5.4.8; 5.2 all versions |
| CVE-2020-29010 | 5.0 | Mar 17 | An exposure of sensitive information to an unauthorized actor vulnerability in FortiOS version 6.2.4 and below, version 6.0.10 and belowmay allow remote authenticated actors to… Affected: 6.2.1 through 6.2.4; 6.0.0 through 6.0.10 |
| CVE-2023-45586 | 5.0 | May 14 | An insufficient verification of data authenticity vulnerability [CWE-345] in Fortinet FortiOS SSL-VPN tunnel mode version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.7 and… Affected: 7.4.0 through 7.4.1; 7.2.0 through 7.2.7; 7.0.0 through 7.0.12; 6.4.0 through 6.4.15; 6.2.0 through 6.2.16 |
| CVE-2025-58903 | 4.9 | Oct 14 | An Unchecked Return Value vulnerability [CWE-252] in Fortinet FortiOS version 7.6.0 through 7.6.3 and before 7.4.8 API allows an authenticated user to cause a Null Pointer… Affected: 7.6.0 through 7.6.3; 7.4.0 through 7.4.8; 7.2.0 through 7.2.12; 7.0.0 through 7.0.18; 6.4.0 through 6.4.16 |
| CVE-2016-7542 | 4.9 | Mar 30 | A read-only administrator on Fortinet devices with FortiOS 5.2.x before 5.2.10 GA and 5.4.x before 5.4.2 GA may have access to read-write administrators password hashes (not… Affected: 5.2.0; 5.2.1; 5.2.2; 5.2.3; 5.2.4; 5.2.5; +6 more |
| CVE-2024-50562 | 4.8 | Jun 10 | An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions… Affected: 7.6.0; 7.4.6; 7.4.0 through 7.4.4; 7.2.0 through 7.2.10; 7.0.0 through 7.0.17; 6.4.0 through 6.4.16 |
| CVE-2024-23111 | 4.8 | Jun 11 | An improper neutralization of input during web page Generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all… Affected: 7.4.0 through 7.4.2; 7.2.0 through 7.2.6; 7.0.0 through 7.0.13 |
| CVE-2023-47537 | 4.8 | Feb 15 | An improper certificate validation vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.15, FortiOS 6.4 all versions … Affected: 7.4.0 through 7.4.1; 7.2.0 through 7.2.6; 7.0.0 through 7.0.15; 6.4.0 through 6.4.16 |
| CVE-2023-29175 | 4.8 | Jun 13 | An improper certificate validation vulnerability [CWE-295] in FortiOS 6.2 all versions, 6.4 all versions, 7.0.0 through 7.0.10, 7.2.0 and FortiProxy 1.2 all versions, 2.0 all… Affected: 7.2.0; 7.0.0 through 7.0.10; 6.4.0 through 6.4.16; 6.2.0 through 6.2.17; 6.0.0 through 6.0.18 |
| CVE-2017-3128 | 4.8 | May 23 | A stored XSS (Cross-Site-Scripting) vulnerability in Fortinet FortiOS allows attackers to execute unauthorized code or commands via the policy global-label parameter Affected: 5.0.0; 5.0.1; 5.0.2; 5.0.3; 5.0.4; 5.0.5; +20 more |
| CVE-2024-26015 | 4.7 | Jul 9 | An incorrect parsing of numbers with different radices vulnerability [CWE-1389] in FortiProxy version 7.4.3 and below, version 7.2.10 and below, version 7.0.17 and below and… Affected: 7.4.0 through 7.4.3; 7.2.0 through 7.2.8; 7.0.0 through 7.0.15 |
| CVE-2020-15936 | 4.5 | Mar 1 | A improper input validation in Fortinet FortiGate version 6.4.3 and below, version 6.2.5 and below, version 6.0.11 and below, version 5.6.13 and below allows attacker to disclose… Affected: FortiOS 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.11, 6.0.10, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0, 5.6.13, 5.6.12, 5.6.11, 5.6.10, 5.6.9, 5.6.8, 5.6.7, 5.6.6, 5.6.5, 5.6.4, 5.6.3, 5.6.2, 5.6.1, 5.6.0 |
| CVE-2024-40593 | 4.4 | Dec 11 | A key management errors vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.2, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all… Affected: 7.6.0; 7.4.4; 7.2.7; 7.0.14 |
| CVE-2024-32122 | 4.4 | Apr 8 | A storing passwords in a recoverable format in Fortinet FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker… Affected: 7.4.0 through 7.4.8; 7.2.0 through 7.2.12; 7.0.0 through 7.0.18; 6.4.0 through 6.4.16 |
| CVE-2024-21754 | 4.4 | Jun 11 | A use of password hash with insufficient computational effort vulnerability [CWE-916] affecting FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 6.4 all… Affected: 7.4.0 through 7.4.3; 7.2.0 through 7.2.8; 7.0.0 through 7.0.15; 6.4.0 through 6.4.15 |
| CVE-2022-41327 | 4.4 | Jun 13 | A cleartext transmission of sensitive information vulnerability [CWE-319] in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.8, FortiProxy version 7.2.0 through… Affected: 7.2.0 through 7.2.3; 7.0.0 through 7.0.8 |
| CVE-2026-59840 | 4.3 | Jul 14 | A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all… Affected: 7.6.0 through 7.6.3; 7.4.0 through 7.4.8; 7.2.0 through 7.2.13; 7.0.0 through 7.0.19; 6.4.0 through 6.4.16 |
| CVE-2025-43892 | 4.3 | Jul 14 | A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions… Affected: 7.4.0 through 7.4.3; 7.2.0 through 7.2.13; 7.0.0 through 7.0.19 |
| CVE-2025-62826 | 4.3 | Jul 14 | An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4… Affected: 7.6.0 through 7.6.2; 7.4.0 through 7.4.8; 7.2.0 through 7.2.13; 7.0.0 through 7.0.19; 6.4.0 through 6.4.16 |
| CVE-2025-62675 | 4.3 | Jul 14 | An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4… Affected: 7.6.0 through 7.6.4; 7.4.0 through 7.4.12; 7.2.0 through 7.2.13; 7.0.0 through 7.0.19; 6.4.0 through 6.4.16 |
| CVE-2025-31514 | 4.3 | Oct 14 | A insertion of sensitive information into log file vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all… Affected: 7.6.0 through 7.6.2; 7.4.0 through 7.4.11; 7.2.0 through 7.2.13; 7.0.0 through 7.0.19; 6.4.0 through 6.4.16 |
| CVE-2025-54822 | 4.3 | Oct 14 | An improper authorization vulnerability [CWE-285] vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.8, FortiOS 7.0.0 through 7.0.11, FortiProxy… Affected: 7.4.0 through 7.4.1; 7.2.0 through 7.2.8; 7.0.0 through 7.0.11 |
| CVE-2025-25255 | 4.3 | Oct 14 | An Improperly Implemented Security Check for Standard vulnerability [CWE-358] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiProxy 7.6.0 through 7.6.3, FortiProxy… Affected: 7.6.0 through 7.6.3 |
| CVE-2024-47569 | 4.3 | Oct 14 | A insertion of sensitive information into sent data vulnerability in Fortinet FortiMail 7.4.0 through 7.4.2, FortiMail 7.2.0 through 7.2.6, FortiMail 7.0 all versions,… Affected: 7.6.0; 7.4.0 through 7.4.4; 7.2.0 through 7.2.8; 7.0.0 through 7.0.15; 6.4.0 through 6.4.15; 6.2.0 through 6.2.17; +1 more |
| CVE-2025-25250 | 4.3 | Jun 10 | An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2 all… Affected: 7.6.0; 7.4.0 through 7.4.7; 7.2.0 through 7.2.13; 7.0.0 through 7.0.19; 6.4.0 through 6.4.16 |
| CVE-2023-46715 | 4.3 | Jan 14 | An origin validation error [CWE-346] vulnerability in Fortinet FortiOS IPSec VPN version 7.4.0 through 7.4.1 and version 7.2.6 and below allows an authenticated IPSec VPN user… Affected: 7.4.0 through 7.4.1; 7.2.0 through 7.2.10; 7.0.0 through 7.0.16; 6.4.0 through 6.4.15; 6.2.0 through 6.2.16 |
| CVE-2024-33510 | 4.3 | Nov 12 | An improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability [CWE-74] in FortiOS version 7.4.3 and below, version 7.2.8 and… Affected: 7.4.0 through 7.4.3; 7.2.0 through 7.2.8; 7.0.0 through 7.0.16 |
| CVE-2024-23112 | 4.3 | Mar 12 | An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiOS version 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.1 through 7.0.13, 6.4.7 through… Affected: 7.4.0 through 7.4.1; 7.2.0 through 7.2.6; 7.0.1 through 7.0.13; 6.4.7 through 6.4.14 |
| CVE-2023-33301 | 4.3 | Oct 10 | An improper access control vulnerability in Fortinet FortiOS 7.2.0 - 7.2.4 and 7.4.0 allows an attacker to access a restricted resource from a non trusted host Affected: 7.4.0; 7.2.0 through 7.2.4 |
| CVE-2023-29178 | 4.3 | Jun 13 | A access of uninitialized pointer vulnerability [CWE-824] vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4, FortiOS 7.0.0 through 7.0.11, FortiOS 6.4 all versions, FortiOS… Affected: 7.2.0 through 7.2.4; 7.0.0 through 7.0.11; 6.4.0 through 6.4.16; 6.2.0 through 6.2.17; 6.0.0 through 6.0.18 |
| CVE-2022-42469 | 4.3 | Apr 11 | A permissive list of allowed inputs vulnerability [CWE-183] in FortiGate version 7.2.3 and below, version 7.0.9 and below Policy-based NGFW Mode may allow an authenticated SSL-VPN… Affected: 7.2.0 through 7.2.3; 7.0.0 through 7.0.9 |
| CVE-2021-43074 | 4.3 | Feb 16 | An improper verification of cryptographic signature vulnerability [CWE-347] in FortiWeb 6.4 all versions, 6.3.16 and below, 6.2 all versions, 6.1 all versions, 6.0 all versions;… Affected: 7.0.0 through 7.0.3; 6.4.0 through 6.4.8; 6.2.0 through 6.2.12; 6.0.0 through 6.0.16 |
| CVE-2022-38380 | 4.3 | Nov 2 | An improper access control [CWE-284] vulnerability in FortiOS version 7.2.0 and versions 7.0.0 through 7.0.7 may allow a remote authenticated read-only user to modify the… Affected: FortiOS 7.2.0, 7.0.7, 7.0.6, 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0 |
| CVE-2022-23442 | 4.3 | Aug 3 | An improper access control vulnerability [CWE-284] in FortiOS versions 6.2.0 through 6.2.11, 6.4.0 through 6.4.8 and 7.0.0 through 7.0.5 may allow an authenticated attacker with a… Affected: FortiOS 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0, 6.4.8, 6.4.7, 6.4.6, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.11, 6.2.10, 6.2.9, 6.2.8, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0 |
| CVE-2021-42755 | 4.3 | Jul 18 | An integer overflow / wraparound vulnerability [CWE-190] in FortiSwitch 7.0.2 and below, 6.4.9 and below, 6.2.x, 6.0.x; FortiRecorder 6.4.2 and below, 6.0.10 and below; FortiOS… Affected: 5.4.0; 5.4.1; 5.4.2; 5.4.3; 5.4.4; 5.4.5; +34 more |
| CVE-2021-43206 | 4.3 | May 4 | A server-generated error message containing sensitive information in Fortinet FortiOS 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.x, 6.0.x and FortiProxy 7.0.0 through 7.0.1,… Affected: 5.6.0 before 6.0.14; 6.2.0 before 6.2.10; 6.4.0 before 6.4.8; 7.0.0 before 7.0.4 |
| CVE-2025-62439 | 4.2 | Feb 10 | An Improper Verification of Source of a Communication Channel vulnerability [CWE-940] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS… Affected: 7.6.0 through 7.6.4; 7.4.0 through 7.4.9; 7.2.0 through 7.2.13; 7.0.0 through 7.0.19 |
| CVE-2022-22305 | 4.2 | Sep 1 | An improper certificate validation vulnerability [CWE-295] in FortiManager 7.0.1 and below, 6.4.6 and below; FortiAnalyzer 7.0.2 and below, 6.4.7 and below; FortiOS 6.2.x and… Affected: 5.6.10 through 5.6.14; 6.0.0 through 6.0.17; 6.2.0 through 6.2.15 |