FO
Network Security
FortiOS
On CISA KEVExploited in the wildRansomware-linked
282
CVEs
21
On KEV
9.8
Max CVSS
2
New 30D
Severity mix
Critical 23High 86Medium 146Low 10
Watch
Add FortiOS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-24858 In wildKEV | 9.8 | Jan 27 | Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability Affected: 7.6.0 through 7.6.5; 7.4.0 through 7.4.10; 7.2.0 through 7.2.12; 7.0.0 through 7.0.18 |
| CVE-2025-25249 In wildKEV | 9.8 | Jan 13 | Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability Affected: 7.6.0 through 7.6.2; 7.4.0 through 7.4.7; 7.2.4 through 7.2.11 |
| CVE-2025-59718 In wildKEV | 9.8 | Dec 9 | Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability Affected: 7.6.0 through 7.6.3; 7.4.0 through 7.4.8; 7.2.0 through 7.2.11; 7.0.0 through 7.0.17 |
| CVE-2024-55591 RansomwareIn wildKEV | 9.8 | Jan 14 | Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability Affected: 7.0.0 through 7.0.16 |
| CVE-2024-23113 In wildKEV | 9.8 | Feb 15 | Fortinet Multiple Products Format String Vulnerability Affected: 7.4.0 through 7.4.2; 7.2.0 through 7.2.6; 7.0.0 through 7.0.13 |
| CVE-2024-21762 RansomwareIn wildKEV | 9.8 | Feb 9 | Fortinet FortiOS Out-of-Bound Write Vulnerability Affected: 7.4.0 through 7.4.2; 7.2.0 through 7.2.6; 7.0.0 through 7.0.13; 6.4.0 through 6.4.14; 6.2.0 through 6.2.15; 6.0.0 through 6.0.18 |
| CVE-2023-27997 RansomwareIn wildKEV | 9.8 | Jun 13 | Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability Affected: 7.2.0 through 7.2.4; 7.0.0 through 7.0.11; 6.4.0 through 6.4.12; 6.2.0 through 6.2.13; 6.0.0 through 6.0.16 |
| CVE-2022-42475 RansomwareIn wildKEV | 9.8 | Jan 2 | Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability Affected: 7.2.0 through 7.2.2; 7.0.0 through 7.0.8; 6.4.0 through 6.4.10; 6.2.0 through 6.2.11; 6.0.0 through 6.0.15; 5.6.0 through 5.6.14; +3 more |
| CVE-2022-40684 RansomwareIn wildKEV | 9.8 | Oct 18 | Fortinet Multiple Products Authentication Bypass Vulnerability Affected: 7.0.0 before 7.0.7; 7.2.0 before 7.2.2 |
| CVE-2020-12812 RansomwareIn wildKEV | 9.8 | Jul 24 | Fortinet FortiOS SSL VPN Improper Authentication Vulnerability Affected: FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below |
| CVE-2018-13379 RansomwareIn wildKEV | 9.8 | Jun 4 | Fortinet FortiOS SSL VPN Path Traversal Vulnerability Affected: 5.4.6 before 5.4.13; 5.6.3 before 5.6.8; 6.0.0 before 6.0.5 |
| CVE-2023-25610 | 9.8 | Mar 24 | A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.6, version 6.4.0… Affected: 5.0.0 before 6.2.13; 6.4.0 before 6.4.12; 7.0.0 before 7.0.10; 7.2.0 before 7.2.4 |
| CVE-2024-48886 | 9.8 | Jan 14 | A weak authentication in Fortinet FortiOS versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, FortiProxy versions 7.4.0 through 7.4.4,… Affected: 6.4.0 before 7.0.16; 7.2.0 before 7.2.9; 7.4.0 before 7.4.5 |
| CVE-2024-26011 | 9.8 | Nov 12 | A missing authentication for critical function vulnerability in Fortinet FortiManager 7.4.0 through 7.4.2, FortiManager 7.2.0 through 7.2.4, FortiManager 7.0.0 through 7.0.11,… Affected: 7.4.0 through 7.4.3; 7.2.0 through 7.2.7; 7.0.0 through 7.0.14; 6.4.0 through 6.4.16; 6.2.0 through 6.2.17; 6.0.0 through 6.0.18 |
| CVE-2023-42789 | 9.8 | Mar 12 | A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0… Affected: 6.2.0 through 6.2.15; 6.4.0 through 6.4.14; 7.0.0 through 7.0.12; 7.2.0 through 7.2.5; 7.4.0; 7.4.1 |
| CVE-2023-33308 | 9.8 | Jul 26 | A stack-based overflow vulnerability [CWE-124] in Fortinet FortiOS version 7.0.0 through 7.0.10 and 7.2.0 through 7.2.3 and FortiProxy version 7.0.0 through 7.0.9 and 7.2.0… Affected: 7.0.0 through 7.0.10; 7.2.0 through 7.2.3 |
| CVE-2023-28001 | 9.8 | Jul 11 | An insufficient session expiration in Fortinet FortiOS 7.0.0 - 7.0.12 and 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or commands via reusing the session of a… Affected: 7.0.0 through 7.0.12; 7.2.0 through 7.2.4 |
| CVE-2022-35843 | 9.8 | Dec 6 | An authentication bypass by assumed-immutable data vulnerability [CWE-302] in the FortiOS SSH login component 7.2.0, 7.0.0 through 7.0.7, 6.4.0 through 6.4.9, 6.2 all versions,… Affected: 6.0.0 through 6.0.15; 6.2.0 through 6.2.12; 6.4.0 through 6.4.9; 7.0.0 through 7.0.7; 7.2.0; 7.2.1 |
| CVE-2021-26109 | 9.8 | Dec 8 | An integer overflow or wraparound vulnerability in the memory allocator of SSLVPN in FortiOS before 7.0.1 may allow an unauthenticated attacker to corrupt control data on the heap… Affected: 6.0.0 through 6.0.12; 6.2.0 through 6.2.9; 6.4.0 through 6.4.5; 7.0.0 |
| CVE-2018-1352 | 9.8 | Feb 8 | A format string vulnerability in Fortinet FortiOS 5.6.0 allows attacker to execute unauthorized code or commands via the SSH username variable Affected: 5.6.0 |
| CVE-2016-6909 | 9.8 | Aug 24 | Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9 and FortiSwitch before 3.4.3 allows remote attackers to… Affected: 4.1.0 before 4.1.11; 4.2.0 before 4.2.13; 4.3.0 before 4.3.9 |
| CVE-2016-1909 | 9.8 | Jan 15 | Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0.8; and FortiOS 4.1.x before 4.1.11, 4.2.x before 4.2.16,… Affected: through 4.3.16; 5.0; 5.0.0; 5.0.1; 5.0.2; 5.0.3; +4 more |
| CVE-2024-48884 | 9.1 | Jan 14 | A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.1 through 7.4.3,… Affected: 7.6.0; 7.4.0 through 7.4.4; 7.2.0 through 7.2.9; 7.0.0 through 7.0.15; 6.4.0 through 6.4.15 |
Showing 23