Skip to content
Exploit Radar Choose my productsProducts My radar

Products › Brands

Brand

Fortinet: actively exploited vulnerabilities

31 vulnerabilities in Fortinet products (FortiOS / FortiProxy (FortiGate), FortiClient EMS, FortiWeb…) are in CISA’s catalog of exploited vulnerabilities, 5 of them added in the last 90 days. Last added: October 1, 2026.

Fortinet security advisories

The brand’s general security advisories page, not the advisory for a specific vulnerability (address checked September 28, 2026).

By category

Add just one Fortinet category to your radar, or open its page.

A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.

Affected products

Follow a single Fortinet product (FortiOS / FortiProxy (FortiGate), FortiClient EMS…) rather than the whole brand.

  • FortiOS / FortiProxy (FortiGate)20 vulnerabilities, Firewalls and VPNs
  • FortiClient EMS3 vulnerabilities, Monitoring and ITSM
  • FortiWeb3 vulnerabilities, ADCs
  • FortiSandbox2 vulnerabilities, Security products
  • FortiMail1 vulnerability, Email
  • FortiManager / FortiAnalyzer1 vulnerability, Firewalls and VPNs
  • FortiVoice / FortiFone1 vulnerability, Collaboration and video

Name used by CISA: Fortinet. Product families: indicative classification by this site.

Pace of additions

Number of Fortinet vulnerabilities added to CISA’s KEV catalog, per 30-day period (the last one, still in progress, ends on October 3, 2026). Source: CISA KEV catalog.
Catalog additions per 30-day period
PeriodVulnerabilities added
Sep 9, 2025 to Oct 8, 20250
Oct 9, 2025 to Nov 7, 20250
Nov 8, 2025 to Dec 7, 20252
Dec 8, 2025 to Jan 6, 20261
Jan 7, 2026 to Feb 5, 20261
Feb 6, 2026 to Mar 7, 20260
Mar 8, 2026 to Apr 6, 20261
Apr 7, 2026 to May 6, 20261
May 7, 2026 to Jun 5, 20260
Jun 6, 2026 to Jul 5, 20260
Jul 6, 2026 to Aug 4, 20263
Aug 5, 2026 to Sep 3, 20260
Sep 4, 2026 to Oct 3, 2026 (in progress)2

Patch first

In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this Fortinet list.

  1. Rank 1

    Fortinet FortiMailCVE-2026-104286

    Fortinet FortiMail Path Traversal Vulnerability

    Recently addedHunt for compromise (CISA)

    CVSS severity 9.8critical

    Added Oct 1, 2026

  2. Rank 2

    Fortinet FortiOS / FortiProxy (FortiGate)CVE-2025-25249

    Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability

    Recently addedHunt for compromise (CISA)

    CVSS severity 9.8critical

    Added Sep 9, 2026

  3. Rank 3

    Fortinet FortiSandboxCVE-2026-25089

    Fortinet FortiSandbox OS Command Injection Vulnerability

    Hunt for compromise (CISA)

    CVSS severity 9.8critical

    Added Jul 16, 2026

  4. Rank 4

    Fortinet FortiSandboxCVE-2026-39808

    Fortinet FortiSandbox OS Command Injection Vulnerability

    Hunt for compromise (CISA)

    CVSS severity 9.8critical

    Added Jul 16, 2026

  5. Rank 5

    Fortinet FortiClient EMSCVE-2026-21643

    Fortinet FortiClient EMS SQL Injection Vulnerability

    CVSS severity 9.8critical

    Added Apr 13, 2026

  6. Rank 6

    Fortinet FortiClient EMSCVE-2026-35616

    Fortinet FortiClient EMS Improper Access Control Vulnerability

    CVSS severity 9.8critical

    Added Apr 6, 2026

  7. Rank 7

    Fortinet FortiOS / FortiProxy (FortiGate)CVE-2026-24858

    Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability

    CVSS severity 9.8critical

    Added Jan 27, 2026

  8. Rank 8

    Fortinet FortiOS / FortiProxy (FortiGate)CVE-2025-59718

    Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability

    CVSS severity 9.8critical

    Added Dec 16, 2025

  9. Rank 9

    Fortinet FortiWebCVE-2025-64446

    Fortinet FortiWeb Path Traversal Vulnerability

    CVSS severity 9.8critical

    Added Nov 14, 2025

  10. Rank 10

    Fortinet FortiWebCVE-2025-58034

    Fortinet FortiWeb OS Command Injection Vulnerability

    CVSS severity 7.2high

    Added Nov 18, 2025

Show 21 more vulnerabilities
  1. Rank 11

    Fortinet FortiOS / FortiProxy (FortiGate)CVE-2025-68686

    Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

    CVSS severity 5.9medium

    Added Jul 27, 2026

  2. Rank 12

    Fortinet FortiWebCVE-2025-25257

    Fortinet FortiWeb SQL Injection Vulnerability

    CVSS severity 9.8critical

    Added Jul 18, 2025

  3. Rank 13

    Fortinet FortiVoice / FortiFoneCVE-2025-32756

    Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability

    CVSS severity 9.8critical

    Added May 14, 2025

  4. Rank 14

    Fortinet FortiOS / FortiProxy (FortiGate)CVE-2024-55591

    Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

    Ransomware

    CVSS severity 9.8critical

    Added Jan 14, 2025

  5. Rank 15

    Fortinet FortiManager / FortiAnalyzerCVE-2024-47575

    Fortinet FortiManager Missing Authentication Vulnerability

    CVSS severity 9.8critical

    Added Oct 23, 2024

  6. Rank 16

    Fortinet FortiOS / FortiProxy (FortiGate)CVE-2024-23113

    Fortinet Multiple Products Format String Vulnerability

    CVSS severity 9.8critical

    Added Oct 9, 2024

  7. Rank 17

    Fortinet FortiClient EMSCVE-2023-48788

    Fortinet FortiClient EMS SQL Injection Vulnerability

    Ransomware

    CVSS severity 9.8critical

    Added Mar 25, 2024

  8. Rank 18

    Fortinet FortiOS / FortiProxy (FortiGate)CVE-2024-21762

    Fortinet FortiOS Out-of-Bound Write Vulnerability

    Ransomware

    CVSS severity 9.8critical

    Added Feb 9, 2024

  9. Rank 19

    Fortinet FortiOS / FortiProxy (FortiGate)CVE-2023-27997

    Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability

    Ransomware

    CVSS severity 9.8critical

    Added Jun 13, 2023

  10. Rank 20

    Fortinet FortiOS / FortiProxy (FortiGate)CVE-2022-42475

    Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability

    Ransomware

    CVSS severity 9.8critical

    Added Dec 13, 2022

  11. Rank 21

    Fortinet FortiOS / FortiProxy (FortiGate)CVE-2022-40684

    Fortinet Multiple Products Authentication Bypass Vulnerability

    Ransomware

    CVSS severity 9.8critical

    Added Oct 11, 2022

  12. Rank 22

    Fortinet FortiOS / FortiProxy (FortiGate)CVE-2018-13379

    Fortinet FortiOS SSL VPN Path Traversal Vulnerability

    RansomwareCVE from 2018, added in 2021

    CVSS severity 9.8critical

    Added Nov 3, 2021

  13. Rank 23

    Fortinet FortiOS / FortiProxy (FortiGate)CVE-2020-12812

    Fortinet FortiOS SSL VPN Improper Authentication Vulnerability

    Ransomware

    CVSS severity 9.8critical

    Added Nov 3, 2021

  14. Rank 24

    Fortinet FortiOS / FortiProxy (FortiGate)CVE-2025-24472

    Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

    Ransomware

    CVSS severity 8.1high

    Added Mar 18, 2025

  15. Rank 25

    Fortinet FortiOS / FortiProxy (FortiGate)CVE-2021-44168

    Fortinet FortiOS Arbitrary File Download

    CVSS severity 7.8high

    Added Dec 10, 2021

  16. Rank 26

    Fortinet FortiOS / FortiProxy (FortiGate)CVE-2018-13382

    Fortinet FortiOS and FortiProxy Improper Authorization

    RansomwareCVE from 2018, added in 2022

    CVSS severity 7.5high

    Added Jan 10, 2022

  17. Rank 27

    Fortinet FortiOS / FortiProxy (FortiGate)CVE-2022-41328

    Fortinet FortiOS Path Traversal Vulnerability

    CVSS severity 7.1high

    Added Mar 14, 2023

  18. Rank 28

    Fortinet FortiOS / FortiProxy (FortiGate)CVE-2019-6693

    Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability

    RansomwareCVE from 2019, added in 2025

    CVSS severity 6.5medium

    Added Jun 25, 2025

  19. Rank 29

    Fortinet FortiOS / FortiProxy (FortiGate)CVE-2018-13383

    Fortinet FortiOS and FortiProxy Out-of-bounds Write

    RansomwareCVE from 2018, added in 2022

    CVSS severity 6.5medium

    Added Jan 10, 2022

  20. Rank 30

    Fortinet FortiOS / FortiProxy (FortiGate)CVE-2019-5591

    Fortinet FortiOS Default Configuration Vulnerability

    RansomwareCVE from 2019, added in 2021

    CVSS severity 6.5medium

    Added Nov 3, 2021

  21. Rank 31

    Fortinet FortiOS / FortiProxy (FortiGate)CVE-2018-13374

    Fortinet FortiOS and FortiADC Improper Access Control Vulnerability

    RansomwareCVE from 2018, added in 2022

    CVSS severity 4.3medium

    Added Sep 8, 2022

Exploitation reported outside CISA’s catalog

Reported by CERT-FR, not (yet) in CISA’s catalog: a different level of evidence, counted separately.

  1. FortinetCVE-2025-61624

    Multiples vulnérabilités dans les produits Fortinet Not (yet) in CISA’s catalog. CERT-FR advisory CERTFR-2026-AVI-0440 of Apr 15, 2026

    Reported by CERT-FR

    CVSS severity 6.5medium

    First reported Apr 15, 2026

Follow and verify

Get new Fortinet vulnerabilities: RSS feed (add it to Outlook, Teams, Slack or your feed reader).

Indicative classification, based on the vendor and product names given by CISA. How products are classified.