Fortinet — security advisories

80 advisories30 exploitedlatest 2026-06-18⚡ RSS feed

Tracked Fortinet products:

⚡ Watch Fortinet

Get an email when a new Fortinet advisory drops — max one per day, one-click unsubscribe.

AL26-014 – FortiBleed leak of thousands of compromised credentials impacting Fortinet devices

criticalexploitedCVE-2024-55591 CVE-2025-59718 CVE-2025-59719cccs2026-06-18

Alert: NCSC issues advice following global targeting of Fortinet firewalls and VPN gateways

unknownncsc-uk2026-06-18

NCSC-2026-0197 [1.00] [M/H] Vulnerability fixed in Fortinet FortiPortal

unknownCVE-2026-49938ncsc-nl2026-06-12

Restricted CLI escape using Lua

unknownCVE-2025-67862fortinet2026-06-09

Improper access control in API endpoints

unknownCVE-2026-49938fortinet2026-06-09

Second-Order OS Command Injection via JSON Input on start vnc feature

unknownCVE-2026-25089fortinet2026-06-09

User controlled SQL commands

unknownCVE-2026-25088fortinet2026-05-12

Improper access control on API endpoints

unknownCVE-2026-44277fortinet2026-05-12

SQL command injection in administrative portal

unknownCVE-2025-53681fortinet2026-05-12

OTP Disclosure via Exported TokenContentProvider

unknownCVE-2026-44279fortinet2026-05-12

OS command injection in CLI

unknownCVE-2025-53870fortinet2026-05-12

Hardcoded Encryption Key Used for VPN Saved Passwords

unknownCVE-2026-44278fortinet2026-05-12

Incorrect global authorization

unknownCVE-2026-26083fortinet2026-05-12

Command injection in CLI

unknownCVE-2025-53680fortinet2026-05-12

DoS due to unsafe function in signal handler

unknownCVE-2025-67604fortinet2026-05-12

Out-of-bounds access in CAPWAP daemon

unknownCVE-2025-53844fortinet2026-05-12

Arbitrary log file read in administrative interface

unknownCVE-2026-25690fortinet2026-05-12

Out-Of-Bounds Write in administrative interface

unknownCVE-2026-40688fortinet2026-04-15

Open Redirection via Import CSV option

unknownCVE-2026-21741fortinet2026-04-14

Multiple Stored XSS

unknownCVE-2026-39812fortinet2026-04-14

Multiple SQL Injections

unknownCVE-2026-39809fortinet2026-04-14

Path Traversal on File Content Extraction connector

unknownCVE-2026-22573fortinet2026-04-14

SSRF via Report template and scheduling

unknownCVE-2025-59809fortinet2026-04-14

Clear-text credentials retrievable with IP modification for connectors

unknownCVE-2026-22576fortinet2026-04-14

Missing Authentication for critical function in CAPWAP daemon

criticalCVE-2025-53847fortinet2026-04-14

Integer Overflow Denial of Service in administrative interface

unknownCVE-2026-39811fortinet2026-04-14

2FA request can be replayed without a valid token after one successful request

unknownCVE-2026-23708fortinet2026-04-14

Credential disclosure in LDAP configuration web page.

unknownCVE-2026-27316fortinet2026-04-14

Cleartext Credentials in response for API endpoints

unknownCVE-2026-21742 CVE-2026-22155fortinet2026-04-14

OS Command Injection through API endpoint

unknownCVE-2026-39808fortinet2026-04-14

Stored Cross Site Scripting (XSS) in Reports View page

unknownCVE-2026-22154fortinet2026-04-14

SQL Injection via JSON RPC API

unknownCVE-2025-61848fortinet2026-04-14

Path Traversal in CLI

unknownCVE-2025-68649fortinet2026-04-14

SQL Injection via API

unknownCVE-2026-39815fortinet2026-04-14

Reflected XSS in Operation Center

unknownCVE-2025-61886fortinet2026-04-14

Arbitrary directory delete on vmimages delete feature

unknownCVE-2026-25691fortinet2026-04-14

Clear-text credentials retrievable with IP modification for LDAP

unknownCVE-2026-22574fortinet2026-04-14

unauthorized backup file access

unknownCVE-2024-23104fortinet2026-04-14

Heap-based buffer overflow in oftpd daemon

unknownCVE-2026-22828fortinet2026-04-14

Path Traversal in CLI

unknownCVE-2025-61624fortinet2026-04-14

Hardcoded symmetric encryption key for Postgresql

unknownCVE-2026-39810fortinet2026-04-14

Multiple Path traversals in CLI

unknownCVE-2026-39814fortinet2026-04-14

Unauthenticated Authentication bypass and Privilege escalation in FortiSandbox

unknownCVE-2026-39813fortinet2026-04-14

CVE-2026-21643: Fortinet FortiClient EMS SQL Injection Vulnerability

criticalexploitedCVE-2026-21643cisa-kev2026-04-13

CVE-2026-35616: Fortinet FortiClient EMS Improper Access Control Vulnerability

criticalexploitedCVE-2026-35616cisa-kev2026-04-06

API authentication and authorization bypass

unknownCVE-2026-35616fortinet2026-04-04

OS command injection on vmimages update feature

unknownCVE-2026-25836fortinet2026-03-10

LDAP authentication bypass in Agentless VPN and FSSO

unknownCVE-2026-22153fortinet2026-02-10

CVE-2026-24858: Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability

criticalexploitedCVE-2026-24858cisa-kev2026-01-27

CVE-2025-59718: Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability

criticalexploitedCVE-2025-59718cisa-kev2025-12-16

Trusted hosts bypass via SSH

unknownCVE-2025-54821fortinet2025-11-18

CVE-2025-58034: Fortinet FortiWeb OS Command Injection Vulnerability

criticalexploitedCVE-2025-58034cisa-kev2025-11-18

CVE-2025-64446: Fortinet FortiWeb Path Traversal Vulnerability

criticalexploitedCVE-2025-64446cisa-kev2025-11-14

Insertion of Sensitive 2FA Information in logs and debug command

unknownCVE-2025-31514fortinet2025-10-14

CVE-2025-25257: Fortinet FortiWeb SQL Injection Vulnerability

criticalexploitedCVE-2025-25257cisa-kev2025-07-18

CVE-2019-6693: Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability

criticalexploitedCVE-2019-6693cisa-kev2025-06-25

Information Disclosure on SSLVPN endpoint

unknownCVE-2025-25250fortinet2025-06-10

CVE-2025-32756: Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability

criticalexploitedCVE-2025-32756cisa-kev2025-05-14

Vulnerability in Fortinet products (May 13, 2025)

unknownexploitedCVE-2025-32756cert-fr-alerte2025-05-13

Post-exploitation activities in Fortinet FortiGate (April 11, 2025)

unknownCVE-2022-42475 CVE-2023-27997 CVE-2024-21762cert-fr-alerte2025-04-11

CVE-2025-24472: Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

criticalexploitedCVE-2025-24472cisa-kev2025-03-18

CVE-2024-55591: Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

criticalexploitedCVE-2024-55591cisa-kev2025-01-14

[Update] Vulnerability in Fortinet products (January 14, 2025)

unknownexploitedCVE-2024-55591cert-fr-alerte2025-01-14

CVE-2024-47575: Fortinet FortiManager Missing Authentication Vulnerability

criticalexploitedCVE-2024-47575cisa-kev2024-10-23

[Update] Multiple vulnerabilities in Fortinet FortiManager (October 23, 2024)

unknownCVE-2024-50566cert-fr-alerte2024-10-23

CVE-2024-23113: Fortinet Multiple Products Format String Vulnerability

criticalexploitedCVE-2024-23113cisa-kev2024-10-09

CVE-2023-48788: Fortinet FortiClient EMS SQL Injection Vulnerability

criticalexploitedCVE-2023-48788cisa-kev2024-03-25

[Update] Vulnerability in Fortinet FortiOS (February 9, 2024)

unknownexploitedCVE-2024-21762cert-fr-alerte2024-02-09

CVE-2024-21762: Fortinet FortiOS Out-of-Bound Write Vulnerability

criticalexploitedCVE-2024-21762cisa-kev2024-02-09

CVE-2023-27997: Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability

criticalexploitedCVE-2023-27997cisa-kev2023-06-13

CVE-2022-41328: Fortinet FortiOS Path Traversal Vulnerability

criticalexploitedCVE-2022-41328cisa-kev2023-03-14

CVE-2022-42475: Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability

criticalexploitedCVE-2022-42475cisa-kev2022-12-13

CVE-2022-40684: Fortinet Multiple Products Authentication Bypass Vulnerability

criticalexploitedCVE-2022-40684cisa-kev2022-10-11

CVE-2018-13374: Fortinet FortiOS and FortiADC Improper Access Control Vulnerability

criticalexploitedCVE-2018-13374cisa-kev2022-09-08

CVE-2018-13383: Fortinet FortiOS and FortiProxy Out-of-bounds Write

criticalexploitedCVE-2018-13383cisa-kev2022-01-10

CVE-2018-13382: Fortinet FortiOS and FortiProxy Improper Authorization

criticalexploitedCVE-2018-13382cisa-kev2022-01-10

CVE-2021-44168: Fortinet FortiOS Arbitrary File Download

criticalexploitedCVE-2021-44168cisa-kev2021-12-10

CVE-2019-5591: Fortinet FortiOS Default Configuration Vulnerability

criticalexploitedCVE-2019-5591cisa-kev2021-11-03

CVE-2018-13379: Fortinet FortiOS SSL VPN Path Traversal Vulnerability

criticalexploitedCVE-2018-13379cisa-kev2021-11-03

CVE-2020-12812: Fortinet FortiOS SSL VPN Improper Authentication Vulnerability

criticalexploitedCVE-2020-12812cisa-kev2021-11-03