FO
Product
FortiProxy
On CISA KEVExploited in the wildRansomware-linked
131
CVEs
13
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 17High 40Medium 69Low 5
Watch
Add FortiProxy to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-24858 In wildKEV | 9.8 | Jan 27 | Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability Affected: 7.6.0 through 7.6.4; 7.4.0 through 7.4.12; 7.2.0 through 7.2.15; 7.0.0 through 7.0.22 |
| CVE-2025-59718 In wildKEV | 9.8 | Dec 9 | Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability Affected: 7.6.0 through 7.6.3; 7.4.0 through 7.4.10; 7.2.0 through 7.2.14; 7.0.0 through 7.0.21 |
| CVE-2024-55591 RansomwareIn wildKEV | 9.8 | Jan 14 | Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability Affected: 7.2.0 through 7.2.12; 7.0.0 through 7.0.19 |
| CVE-2024-23113 In wildKEV | 9.8 | Feb 15 | Fortinet Multiple Products Format String Vulnerability Affected: 7.4.0 through 7.4.2; 7.2.0 through 7.2.8; 7.0.0 through 7.0.15 |
| CVE-2024-21762 RansomwareIn wildKEV | 9.8 | Feb 9 | Fortinet FortiOS Out-of-Bound Write Vulnerability Affected: 7.4.0 through 7.4.2; 7.2.0 through 7.2.8; 7.0.0 through 7.0.14; 2.0.0 through 2.0.13; 1.2.1 through 1.2.13; 01.02.00; +3 more |
| CVE-2023-27997 RansomwareIn wildKEV | 9.8 | Jun 13 | Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability Affected: 7.2.0 through 7.2.3; 7.0.0 through 7.0.9; 2.0.0 through 2.0.12; 1.2.0 through 1.2.13; 1.1.0 through 1.1.6 |
| CVE-2022-42475 RansomwareIn wildKEV | 9.8 | Jan 2 | Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability Affected: 7.2.0 through 7.2.1; 7.0.0 through 7.0.7; 2.0.0 through 2.0.11; 1.2.0 through 1.2.13; 1.1.0 through 1.1.6; 1.0.0 through 1.0.7 |
| CVE-2022-40684 RansomwareIn wildKEV | 9.8 | Oct 18 | Fortinet Multiple Products Authentication Bypass Vulnerability Affected: 7.0.0 before 7.0.7; 7.2.0 |
| CVE-2018-13379 RansomwareIn wildKEV | 9.8 | Jun 4 | Fortinet FortiOS SSL VPN Path Traversal Vulnerability Affected: before 1.2.9; 2.0.0 |
| CVE-2025-24472 RansomwareIn wildKEV | 8.1 | Feb 11 | Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability Affected: 7.2.0 through 7.2.12; 7.0.0 through 7.0.19 |
| CVE-2018-13382 RansomwareIn wildKEV | 7.5 | Jun 4 | Fortinet FortiOS and FortiProxy Improper Authorization Affected: before 1.2.9; 2.0.0 |
| CVE-2025-61624 In wildKEV | 6.5 | Apr 14 | Fortinet Multiple Products Path Traversal Vulnerability Affected: 7.6.0 through 7.6.4; 7.4.0 through 7.4.11; 7.2.0 through 7.2.16; 7.0.0 through 7.0.23 |
| CVE-2018-13383 RansomwareIn wildKEV | 6.5 | May 29 | Fortinet FortiOS and FortiProxy Out-of-bounds Write Affected: before 1.2.9; 2.0.0 |
| CVE-2023-25610 | 9.8 | Mar 24 | A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.6, version 6.4.0… Affected: 1.1.0 before 7.0.9; 7.2.0 before 7.2.3 |
| CVE-2024-48886 | 9.8 | Jan 14 | A weak authentication in Fortinet FortiOS versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, FortiProxy versions 7.4.0 through 7.4.4,… Affected: 2.0.0 before 2.0.15; 7.0.0 before 7.0.18; 7.2.0 before 7.2.11; 7.4.0 before 7.4.5 |
| CVE-2024-26011 | 9.8 | Nov 12 | A missing authentication for critical function vulnerability in Fortinet FortiManager 7.4.0 through 7.4.2, FortiManager 7.2.0 through 7.2.4, FortiManager 7.0.0 through 7.0.11,… Affected: 7.4.0 through 7.4.3; 7.2.0 through 7.2.9; 7.0.0 through 7.0.16; 2.0.0 through 2.0.14; 1.2.1 through 1.2.13; 01.02.00; +3 more |
| CVE-2023-42789 | 9.8 | Mar 12 | A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0… Affected: 2.0.0 through 2.0.13; 7.0.0 through 7.0.12; 7.2.0 through 7.2.6; 7.4.0 |
| CVE-2023-33308 | 9.8 | Jul 26 | A stack-based overflow vulnerability [CWE-124] in Fortinet FortiOS version 7.0.0 through 7.0.10 and 7.2.0 through 7.2.3 and FortiProxy version 7.0.0 through 7.0.9 and 7.2.0… Affected: 7.0.0 through 7.0.9; 7.2.0; 7.2.1; 7.2.2 |
| CVE-2022-41331 | 9.8 | Apr 11 | A missing authentication for critical function vulnerability [CWE-306] in FortiPresence infrastructure server before version 1.2.1 allows a remote, unauthenticated attacker to… Affected: 1.0.0 before 2.0.0 |
| CVE-2022-35843 | 9.8 | Dec 6 | An authentication bypass by assumed-immutable data vulnerability [CWE-302] in the FortiOS SSH login component 7.2.0, 7.0.0 through 7.0.7, 6.4.0 through 6.4.9, 6.2 all versions,… Affected: 1.2.0 through 1.2.13; 2.0.0 through 2.0.10; 7.0.0 through 7.0.6 |
| CVE-2024-48884 | 9.1 | Jan 14 | A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.1 through 7.4.3,… Affected: 7.4.0 through 7.4.5; 7.2.0 through 7.2.11; 7.0.0 through 7.0.18; 2.0.0 through 2.0.14; 1.2.1 through 1.2.13; 01.02.00; +3 more |
| CVE-2025-57740 | 8.8 | Oct 14 | An Heap-based Buffer Overflow vulnerability [CWE-122] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions;… Affected: 7.6.0 through 7.6.2; 7.4.0 through 7.4.3; 7.2.0 through 7.2.15; 7.0.0 through 7.0.22 |
| CVE-2023-37930 | 8.8 | Apr 8 | Multiple issues including the use of uninitialized ressources [CWE-908] and excessive iteration [CWE-834] vulnerabilities vulnerability in Fortinet allows a VPN user to corrupt… Affected: 7.0.0 before 7.0.13; 7.2.0 before 7.2.7 |
| CVE-2022-45862 | 8.8 | Aug 13 | An insufficient session expiration vulnerability [CWE-613] vulnerability in FortiOS 7.2.5 and below, 7.0 all versions, 6.4 all versions; FortiProxy 7.2 all versions, 7.0 all… Affected: 7.0.0 before 7.4.0 |
| CVE-2023-41677 | 8.8 | Apr 9 | A insufficiently protected credentials vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4.0 through… Affected: 7.4.0 through 7.4.1; 7.2.0 through 7.2.7; 7.0.0 through 7.0.13; 2.0.0 through 2.0.14; 1.2.1 through 1.2.13; 01.02.00; +3 more |
| CVE-2023-29181 | 8.8 | Feb 22 | A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4, FortiOS 7.0.0 through 7.0.11, FortiOS 6.4.0 through 6.4.12, FortiOS 6.2.0… Affected: 7.2.0 through 7.2.4; 7.0.0 through 7.0.10; 2.0.0 through 2.0.12; 1.2.1 through 1.2.13; 01.02.00; 1.1.4 through 1.1.6; +2 more |
| CVE-2023-44250 | 8.8 | Jan 10 | An improper privilege management vulnerability [CWE-269] in a Fortinet FortiOS HA cluster version 7.4.0 through 7.4.1 and 7.2.5 and in a FortiProxy HA cluster version 7.4.0… Affected: 7.4.0; 7.4.1 |
| CVE-2023-36639 | 8.8 | Dec 13 | A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, FortiOS versions 7.4.0, 7.2.0 through 7.2.4, 7.0.0 through… Affected: 7.0.0 through 7.0.10; 7.2.0 through 7.2.4 |
| CVE-2023-22640 | 8.8 | May 3 | A out-of-bounds write vulnerability in Fortinet FortiOS 7.2.0 through 7.2.3, FortiOS 7.0.0 through 7.0.10, FortiOS 6.4.0 through 6.4.11, FortiOS 6.2.0 through 6.2.13, FortiOS… Affected: 7.2.0 through 7.2.1; 7.0.0 through 7.0.7; 2.0.0 through 2.0.14; 1.2.1 through 1.2.13; 01.02.00; 1.1.4 through 1.1.6; +2 more |
| CVE-2022-43947 | 8.8 | Apr 11 | An improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiOS version 7.2.0 through 7.2.3 and before 7.0.10, FortiProxy version 7.2.0… Affected: 1.0.0 through 2.0.9; 7.0.0 before 7.0.8; 7.2.0 before 7.2.2 |
| CVE-2021-26103 | 8.8 | Dec 8 | An insufficient verification of data authenticity vulnerability (CWE-345) in the user interface of FortiProxy verison 2.0.3 and below, 1.2.11 and below and FortiGate verison… Affected: 1.2.0 through 1.2.11; 2.0.0 through 2.0.3 |
| CVE-2022-42476 | 8.2 | Mar 7 | A relative path traversal vulnerability [CWE-23] vulnerability in Fortinet FortiOS 7.2.0 through 7.2.3, FortiOS 7.0.0 through 7.0.8, FortiOS 6.4.0 through 6.4.11, FortiOS 6.2.0… Affected: 7.2.0 through 7.2.1; 7.0.0 through 7.0.7; 2.0.0 through 2.0.11; 1.2.1 through 1.2.13; 01.02.00; 1.1.4 through 1.1.6; +1 more |
| CVE-2026-84393 | 8.1 | Sep 8 | A improper validation of certificate with host mismatch vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6, FortiProxy 7.6.2 through 7.6.6 may allow attacker to information… Affected: 7.6.2 through 7.6.6 |
| CVE-2026-71407 | 8.1 | Aug 12 | A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6 may allow an unauthenticated attacker who can bypass stack protection… Affected: 7.6.0 through 7.6.4; 7.4.0 through 7.4.11; 7.2.0 through 7.2.16; 7.0.0 through 7.0.23 |
| CVE-2024-26009 | 8.1 | Aug 12 | An authentication bypass using an alternate path or channel [CWE-288] vulnerability in Fortinet FortiOS 6.4.0 through 6.4.15, FortiOS 6.2.0 through 6.2.16, FortiOS 6.0 all… Affected: 7.0.0 before 7.0.16; 7.2.0 before 7.2.9; 7.4.0 before 7.4.3 |
| CVE-2023-42790 | 8.1 | Mar 12 | A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4.0 through 6.4.14,… Affected: 2.0.0 through 2.0.13; 7.0.0 through 7.0.12; 7.2.0 through 7.2.6; 7.4.0 |
| CVE-2022-41335 | 8.1 | Feb 16 | A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.10, FortiProxy version 7.2.0 through 7.2.1,… Affected: 1.1.0 through 1.1.6; 1.2.0 through 1.2.13; 2.0.0 through 2.0.10; 7.0.0 through 7.0.7; 7.2.0; 7.2.1 |
| CVE-2023-46718 | 7.8 | Oct 14 | A stack-based buffer overflow in Fortinet FortiOS version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.7 and 7.0.0 through 7.0.12 and 6.4.6 through 6.4.15 and 6.2.9 through 6.2.16… Affected: 7.0.0 before 7.4.8 |
| CVE-2023-22639 | 7.8 | Jun 13 | A out-of-bounds write in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.10, FortiOS version 6.4.0 through 6.4.12, FortiOS all versions 6.2,… Affected: 1.0.0 through 1.0.7; 1.1.0 through 1.1.6; 1.2.0 through 1.2.13; 2.0.0 through 2.0.12; 7.0.0 through 7.0.8; 7.2.0; +2 more |
| CVE-2022-43953 | 7.8 | Jun 13 | A use of externally-controlled format string in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS all versions 7.0, FortiOS all versions 6.4, FortiOS all versions 6.2,… Affected: 7.0.0 through 7.0.7; 7.2.0; 7.2.1 |
| CVE-2022-22299 | 7.8 | Aug 5 | A format string vulnerability [CWE-134] in the command line interpreter of FortiADC version 6.0.0 through 6.0.4, FortiADC version 6.1.0 through 6.1.5, FortiADC version 6.2.0… Affected: 1.0.0 through 1.0.7; 1.1.0 through 1.1.6; 1.2.0 through 1.2.13; 2.0.0 through 2.0.7; 7.0.0; 7.0.1 |
| CVE-2021-26110 | 7.8 | Dec 8 | An improper access control vulnerability [CWE-284] in FortiOS autod daemon 7.0.0, 6.4.6 and below, 6.2.9 and below, 6.0.12 and below and FortiProxy 2.0.1 and below, 1.2.9 and… Affected: 1.0.0 through 1.0.7; 1.1.0 through 1.1.6; 1.2.0 through 1.2.9; 2.0.0; 2.0.1 |
| CVE-2025-25253 | 7.5 | Oct 14 | An Improper Validation of Certificate with Host Mismatch vulnerability [CWE-297] in FortiProxy version 7.6.1 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions… Affected: 7.6.0 through 7.6.1; 7.4.0 through 7.4.8; 7.2.0 through 7.2.15; 7.0.0 through 7.0.22 |
| CVE-2024-50565 | 7.5 | Apr 8 | A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0.0 through… Affected: 2.0.0 before 7.0.16; 7.2.0 before 7.2.10; 7.4.0 before 7.4.3 |
| CVE-2024-26013 | 7.5 | Apr 8 | A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS version 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through… Affected: 2.0.0 before 7.0.16; 7.2.0 before 7.2.10; 7.4.0 before 7.4.3 |
| CVE-2024-26010 | 7.5 | Jun 11 | A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.3, FortiOS 7.2.0 through 7.2.7, FortiOS 7.0.0 through 7.0.14, FortiOS 6.4 all versions, FortiOS… Affected: 7.4.0 through 7.4.3; 7.2.0 through 7.2.9; 7.0.0 through 7.0.16; 2.0.0 through 2.0.14; 1.2.1 through 1.2.13; 01.02.00; +3 more |
| CVE-2023-29180 | 7.5 | Feb 22 | A null pointer dereference vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4, FortiOS 7.0.0 through 7.0.11, FortiOS 6.4.0 through 6.4.12, FortiOS 6.2.0 through 6.2.14, FortiOS… Affected: 7.2.0 through 7.2.3; 7.0.0 through 7.0.10; 2.0.0 through 2.0.12; 1.2.1 through 1.2.13; 01.02.00; 1.1.4 through 1.1.6; +2 more |
| CVE-2022-29055 | 7.5 | Oct 10 | A access of uninitialized pointer in Fortinet FortiOS version 7.2.0, 7.0.0 through 7.0.5, 6.4.0 through 6.4.8, 6.2.0 through 6.2.10, 6.0.x, FortiProxy version 7.0.0 through 7.0.4,… Affected: 1.2.6 before 1.2.13; 2.0.0 before 2.0.10; 7.0.0 before 7.0.7; 7.2.0 |
| CVE-2021-41024 | 7.5 | Dec 8 | A relative path traversal [CWE-23] vulnerabiltiy in FortiOS versions 7.0.0 and 7.0.1 and FortiProxy verison 7.0.0 may allow an unauthenticated, unauthorized attacker to inject… Affected: 7.0.0 |
| CVE-2018-13381 | 7.5 | Jun 4 | A buffer overflow vulnerability in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.7, 5.4 and earlier versions and FortiProxy 2.0.0, 1.2.8 and earlier versions under SSL… Affected: through 1.2.8; 2.0.0 |