Vendor
Fortinet
1,174 known vulnerabilities in products by Fortinet, 33 of them actively exploited (CISA KEV).
Key figures
1,174
Vulnerabilities
33
Actively exploited (KEV)
14
Used by ransomware
145
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority.
| Severity | CVE | Title | CVSS | Published |
|---|---|---|---|---|
| Critical | CVE-2024-55591 | Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability In CISA KEVRansomware | 9.6 | |
| Critical | CVE-2024-21762 | Fortinet FortiOS Out-of-Bound Write Vulnerability In CISA KEVRansomware | 9.6 | |
| Critical | CVE-2023-48788 | Fortinet FortiClient EMS SQL Injection Vulnerability In CISA KEVRansomware | 9.3 | |
| Critical | CVE-2022-40684 | Fortinet Multiple Products Authentication Bypass Vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2023-27997 | Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability In CISA KEVRansomware | 9.2 | |
| Critical | CVE-2022-42475 | Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability In CISA KEVRansomware | 9.3 | |
| Critical | CVE-2020-12812 | Fortinet FortiOS SSL VPN Improper Authentication Vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2018-13379 | Fortinet FortiOS SSL VPN Path Traversal Vulnerability In CISA KEVRansomware | 9.1 | |
| Critical | CVE-2018-13382 | Fortinet FortiOS and FortiProxy Improper Authorization In CISA KEVRansomware | 9.1 | |
| Critical | CVE-2023-44487 | HTTP/2 Rapid Reset Attack Vulnerability In CISA KEV | 7.5 | |
| Critical | CVE-2025-24472 | Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability In CISA KEVRansomware | 8.1 | |
| Critical | CVE-2026-25089 | Fortinet FortiSandbox OS Command Injection Vulnerability In CISA KEV | 9.1 | |
| Critical | CVE-2026-24858 | Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability In CISA KEV | 9.4 | |
| Critical | CVE-2026-39808 | Fortinet FortiSandbox OS Command Injection Vulnerability In CISA KEV | 9.1 | |
| Critical | CVE-2026-21643 | Fortinet FortiClient EMS SQL Injection Vulnerability In CISA KEV | 9.1 | |
| Critical | CVE-2025-25257 | Fortinet FortiWeb SQL Injection Vulnerability In CISA KEV | 9.6 | |
| Critical | CVE-2025-64446 | Fortinet FortiWeb Path Traversal Vulnerability In CISA KEV | 9.4 | |
| Critical | CVE-2025-59718 | Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability In CISA KEV | 9.1 | |
| Critical | CVE-2024-47575 | Fortinet FortiManager Missing Authentication Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2025-32756 | Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability In CISA KEV | 9.6 | |
| Critical | CVE-2026-35616 | Fortinet FortiClient EMS Improper Access Control Vulnerability In CISA KEV | 9.1 | |
| Critical | CVE-2026-104286 | Fortinet FortiMail Path Traversal Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2019-5591 | Fortinet FortiOS Default Configuration Vulnerability In CISA KEVRansomware | 6.5 | |
| Critical | CVE-2024-23113 | Fortinet Multiple Products Format String Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2025-25249 | Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability In CISA KEV | 7.4 |
News
- Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Executionthehackernews,
- PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessionsthehackernews,
- NCSC-2026-0428 [1.00] [M/H] Kwetsbaarheden verholpen in Fortinet FortiSandboxncsc-nl,
- Exploited Fortinet FortiMail Zero-Day Calls for Urgent Actionsecurityweek,
- NCSC-2026-0398 [1.00] [M/H] Kwetsbaarheid verholpen in Fortinet FortiMailncsc-nl,
- Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writesthehackernews,