Cyberfeed6 › Vendors › Fortinet
CISA lists 32 Fortinet vulnerabilities as exploited in real attacks, and 14 of them are known to be used in ransomware campaigns. Most entries concern FortiOS, Multiple Products, FortiOS and FortiProxy, FortiClient EMS.
Showing the 32 most recently added of 32. Check the vendor notice before you act: it names the fixed versions.
| Vulnerability | Product | Added to list | Severity | Ransomware | Fix |
|---|---|---|---|---|---|
| CVE-2025-61624Fortinet Multiple Products Path Traversal Vulnerability | Multiple Products | 2026-10-16 | Medium (5.4) | No | Vendor notice |
| CVE-2026-104286Fortinet FortiMail Path Traversal Vulnerability | FortiMail | 2026-10-01 | Critical (9.8) | No | Vendor notice |
| CVE-2025-25249Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability | Multiple Products | 2026-09-09 | High (7.4) | No | Vendor notice |
| CVE-2025-68686Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability | FortiOS | 2026-07-27 | Medium (5.3) | No | Vendor notice |
| CVE-2026-39808Fortinet FortiSandbox OS Command Injection Vulnerability | FortiSandbox | 2026-07-16 | Critical (9.1) | No | Vendor notice |
| CVE-2026-25089Fortinet FortiSandbox OS Command Injection Vulnerability | FortiSandbox | 2026-07-16 | Critical (9.1) | No | Vendor notice |
| CVE-2026-21643Fortinet FortiClient EMS SQL Injection Vulnerability | FortiClient EMS | 2026-04-13 | Critical (9.1) | No | Vendor notice |
| CVE-2026-35616Fortinet FortiClient EMS Improper Access Control Vulnerability | FortiClient EMS | 2026-04-06 | Critical (9.1) | No | Vendor notice |
| CVE-2026-24858Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability | Multiple Products | 2026-01-27 | Critical (9.4) | No | Vendor notice |
| CVE-2025-59718Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability | Multiple Products | 2025-12-16 | Critical (9.1) | No | Vendor notice |
| CVE-2025-58034Fortinet FortiWeb OS Command Injection Vulnerability | FortiWeb | 2025-11-18 | Medium (6.7) | No | Vendor notice |
| CVE-2025-64446Fortinet FortiWeb Path Traversal Vulnerability | FortiWeb | 2025-11-14 | Critical (9.4) | No | Vendor notice |
| CVE-2025-25257Fortinet FortiWeb SQL Injection Vulnerability | FortiWeb | 2025-07-18 | Critical (9.6) | No | Vendor notice |
| CVE-2019-6693Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability | FortiOS | 2025-06-25 | Medium (6.5) | Yes | Vendor notice |
| CVE-2025-32756Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability | Multiple Products | 2025-05-14 | Critical (9.6) | No | Vendor notice |
| CVE-2025-24472Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability | FortiOS and FortiProxy | 2025-03-18 | High (8.1) | Yes | Vendor notice |
| CVE-2024-55591Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability | FortiOS and FortiProxy | 2025-01-14 | Critical (9.6) | Yes | Vendor notice |
| CVE-2024-47575Fortinet FortiManager Missing Authentication Vulnerability | FortiManager | 2024-10-23 | Critical (9.8) | No | Vendor notice |
| CVE-2024-23113Fortinet Multiple Products Format String Vulnerability | Multiple Products | 2024-10-09 | Critical (9.8) | No | Vendor notice |
| CVE-2023-48788Fortinet FortiClient EMS SQL Injection Vulnerability | FortiClient EMS | 2024-03-25 | Critical (9.3) | Yes | Vendor notice |
| CVE-2024-21762Fortinet FortiOS Out-of-Bound Write Vulnerability | FortiOS | 2024-02-09 | Critical (9.6) | Yes | Vendor notice |
| CVE-2023-27997Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability | FortiOS and FortiProxy SSL-VPN | 2023-06-13 | Critical (9.2) | Yes | Vendor notice |
| CVE-2022-41328Fortinet FortiOS Path Traversal Vulnerability | FortiOS | 2023-03-14 | Medium (6.5) | No | Vendor notice |
| CVE-2022-42475Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability | FortiOS | 2022-12-13 | Critical (9.3) | Yes | Vendor notice |
| CVE-2022-40684Fortinet Multiple Products Authentication Bypass Vulnerability | Multiple Products | 2022-10-11 | Critical (9.8) | Yes | Vendor notice |
| CVE-2018-13374Fortinet FortiOS and FortiADC Improper Access Control Vulnerability | FortiOS and FortiADC | 2022-09-08 | Medium (4.3) | Yes | Vendor notice |
| CVE-2018-13383Fortinet FortiOS and FortiProxy Out-of-bounds Write | FortiOS and FortiProxy | 2022-01-10 | Medium (4.3) | Yes | |
| CVE-2018-13382Fortinet FortiOS and FortiProxy Improper Authorization | FortiOS and FortiProxy | 2022-01-10 | Critical (9.1) | Yes | |
| CVE-2021-44168Fortinet FortiOS Arbitrary File Download | FortiOS | 2021-12-10 | Low (3.3) | No | |
| CVE-2020-12812Fortinet FortiOS SSL VPN Improper Authentication Vulnerability | FortiOS | 2021-11-03 | High (7.5) | Yes | |
| CVE-2019-5591Fortinet FortiOS Default Configuration Vulnerability | FortiOS | 2021-11-03 | Medium (6.5) | Yes | |
| CVE-2018-13379Fortinet FortiOS SSL VPN Path Traversal Vulnerability | FortiOS | 2021-11-03 | Critical (9.1) | Yes |
Source: CISA Known Exploited Vulnerabilities catalog, released 2026-11-04. Severity scores are CVSS where available. "Ransomware" means CISA has marked the flaw as known to be used in ransomware campaigns.