By year
05
06
08
09
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
Bars are flaws published each year; the red part is the share attackers have used.
Exploited Fortinet flaws
These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.
- CVE-2025-61624 Fortinet Multiple Products Path TraversalExploited since Oct 16, 2026 · CVSS 6
- CVE-2026-104286 Fortinet FortiMail Path TraversalExploited since Oct 1, 2026 · CVSS 9.8
- CVE-2025-25249 Fortinet Multiple Products Heap-based Buffer OverflowExploited since Sep 9, 2026 · CVSS 8.1
- CVE-2025-68686 Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized ActorExploited since Jul 27, 2026 · CVSS 5.9
- CVE-2026-39808 Fortinet FortiSandbox OS Command InjectionExploited since Jul 16, 2026 · CVSS 9.8
- CVE-2026-25089 Fortinet FortiSandbox OS Command InjectionExploited since Jul 16, 2026 · CVSS 9.8
- CVE-2026-21643 Fortinet FortiClient EMS SQL InjectionExploited since Apr 13, 2026 · CVSS 9.8
- CVE-2026-35616 Fortinet FortiClient EMS Improper Access ControlExploited since Apr 6, 2026 · CVSS 9.8
- CVE-2026-24858 Fortinet Multiple Products Authentication Bypass Using an Alternate Path or ChannelExploited since Jan 27, 2026 · CVSS 9.8
- CVE-2025-59718 Fortinet Multiple Products Improper Verification of Cryptographic SignatureExploited since Dec 16, 2025 · CVSS 9.8
- CVE-2025-58034 Fortinet FortiWeb OS Command InjectionExploited since Nov 18, 2025 · CVSS 7.2
- CVE-2025-64446 Fortinet FortiWeb Path TraversalExploited since Nov 14, 2025 · CVSS 9.8
- CVE-2025-25257 Fortinet FortiWeb SQL InjectionExploited since Jul 18, 2025 · CVSS 9.8
- CVE-2019-6693 Fortinet FortiOS Use of Hard-Coded CredentialsExploited since Jun 25, 2025 · ransomware · CVSS 6.5
- CVE-2025-32756 Fortinet Multiple Products Stack-Based Buffer OverflowExploited since May 14, 2025 · CVSS 9.8
- CVE-2025-24472 Fortinet FortiOS and FortiProxy Authentication BypassExploited since Mar 18, 2025 · ransomware · CVSS 8.1
- CVE-2024-55591 Fortinet FortiOS and FortiProxy Authentication BypassExploited since Jan 14, 2025 · ransomware · CVSS 9.8
- CVE-2024-47575 Fortinet FortiManager Missing AuthenticationExploited since Oct 23, 2024 · CVSS 9.8
- CVE-2024-23113 Fortinet Multiple Products Format StringExploited since Oct 9, 2024 · CVSS 9.8
- CVE-2023-48788 Fortinet FortiClient EMS SQL InjectionExploited since Mar 25, 2024 · ransomware · CVSS 9.8
- CVE-2024-21762 Fortinet FortiOS Out-of-Bound WriteExploited since Feb 9, 2024 · ransomware · CVSS 9.8
- CVE-2023-27997 Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer OverflowExploited since Jun 13, 2023 · ransomware · CVSS 9.8
- CVE-2022-41328 Fortinet FortiOS Path TraversalExploited since Mar 14, 2023 · CVSS 6.7
- CVE-2022-42475 Fortinet FortiOS Heap-Based Buffer OverflowExploited since Dec 13, 2022 · ransomware · CVSS 9.8
- CVE-2022-40684 Fortinet Multiple Products Authentication BypassExploited since Oct 11, 2022 · ransomware · CVSS 9.8
- CVE-2018-13374 Fortinet FortiOS and FortiADC Improper Access ControlExploited since Sep 8, 2022 · ransomware · CVSS 4.3
- CVE-2018-13382 Fortinet FortiOS and FortiProxy Improper AuthorizationExploited since Jan 10, 2022 · ransomware · CVSS 9.1
- CVE-2018-13383 Fortinet FortiOS and FortiProxy Out-of-bounds WriteExploited since Jan 10, 2022 · ransomware · CVSS 4.3
- CVE-2021-44168 Fortinet FortiOS Arbitrary File DownloadExploited since Dec 10, 2021 · CVSS 3.3
- CVE-2020-12812 Fortinet FortiOS SSL VPN Improper AuthenticationExploited since Nov 3, 2021 · ransomware · CVSS 9.8
- CVE-2019-5591 Fortinet FortiOS Default ConfigurationExploited since Nov 3, 2021 · ransomware · CVSS 6.5
- CVE-2018-13379 Fortinet FortiOS SSL VPN Path TraversalExploited since Nov 3, 2021 · ransomware · CVSS 9.1
Latest high and critical flaws
- CVE-2026-106174 A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network access to the device High 7.5 · Oct 27, 2026
- CVE-2026-107656 An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSCritical 9.8 · Oct 26, 2026
- CVE-2026-23707 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 thrHigh 7.2 · Oct 13, 2026
- CVE-2026-23705 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 thrHigh 7.2 · Oct 13, 2026
- CVE-2026-106173 A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthoCritical 9.8 · Oct 13, 2026
- CVE-2025-57739 An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 throughHigh 8.8 · Oct 13, 2026
- CVE-2025-46773 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 thrHigh 8.8 · Oct 13, 2026
- CVE-2026-104286 Fortinet FortiMail Path TraversalExploited · Critical 9.8 · Oct 1, 2026
- CVE-2026-84388 A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions, FortiPAM Chrome Extension 7.4 all vCritical 9.6 · Sep 22, 2026
- CVE-2026-84390 A inclusion of sensitive information in source code vulnerability in Fortinet FortiMonitorOnSight 7.2.4 through 7.2.7, FortiMonitorOnSight 7.2.0 through 7.2.2 mCritical 9.8 · Sep 11, 2026
- CVE-2026-84393 A improper validation of certificate with host mismatch vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6, FortiProxy 7.6.2 through 7.6.6 may allow attackerHigh 8.1 · Sep 8, 2026
- CVE-2026-84387 A improper neutralization of special elements used in a command ('command injection') vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 through 5High 7.2 · Sep 8, 2026
- CVE-2026-26084 A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, Critical 9.9 · Sep 8, 2026
- CVE-2026-70468 A authentication bypass using an alternate path or channel vulnerability in Fortinet FortiManager 7.6.1, FortiManager 7.4.3 through 7.4.5, FortiManager 7.2.5 thHigh 8.1 · Aug 12, 2026
- CVE-2026-26035 An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through Critical 9.8 · Aug 12, 2026
- CVE-2026-70465 A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.High 8.1 · Aug 12, 2026
- CVE-2026-59841 A improper restriction of communication channel to intended endpoints vulnerability in Fortinet FortiSIEMWindowsAgent 7.4.0 through 7.4.1 may allow attacker to High 7.5 · Jul 14, 2026
- CVE-2026-59836 A improper certificate validation vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.5, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2 all versiHigh 7.5 · Jul 14, 2026
- CVE-2026-59835 A exposure of resource to wrong sphere vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.3 through 4.4.8 may allow an unauthenticatedHigh 8.6 · Jul 14, 2026
- CVE-2025-53379 A out-of-bounds read vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.2, FortiAuthenticator 6.5 all versions may allow a remote unauthenticated atHigh 7.5 · Jul 14, 2026
- CVE-2026-25089 Fortinet FortiSandbox OS Command InjectionExploited · Critical 9.8 · Jun 9, 2026
- CVE-2026-44277 A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthenticatCritical 9.8 · May 12, 2026
- CVE-2026-26083 A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through 5.0.5, FoCritical 9.8 · May 12, 2026
- CVE-2025-53844 A out-of-bounds write vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11 allows attacker to executHigh 8.8 · May 12, 2026
- CVE-2025-53681 An improper neutralization of special elements used in an SQL Command ("SQL Injection&") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 througHigh 7.2 · May 12, 2026
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.