Fortinet flaws being used in attacks
CISA lists 32 flaws in Fortinet products as being used in attacks, most recently on 16 Oct 2026. 14 have been used in ransomware.
FortinetBeing used in attacks
- On CISA’s list
- 32 flaws, added between 3 Nov 2021 and 16 Oct 2026
- Most recent
- CVE-2025-61624, Fortinet Multiple Products Path Traversal Vulnerability, added 16 Oct 2026
- Used in ransomware
- 14 flaws, according to CISA
- Products
- FortiOS (9), Multiple Products (7), FortiOS and FortiProxy (4), FortiClient EMS (3), FortiWeb (3), and 5 more
What to do
- Update every Fortinet product you use.Install the updates Fortinet offers, on every device, and restart when asked. Each flaw below has a fix or clear advice; that’s one of CISA’s conditions for listing it.
- If someone looks after IT for you, send them this page.Many of these are in equipment you don’t see: routers, firewalls, servers, the office network. Ask them to confirm each one is fixed, or that you don’t use the product.
- Check anything else in the lookup.Search any app, company or CVE. Not being on CISA’s list doesn’t mean safe: keep updating either way.
Every flaw, newest first
- Fortinet Multiple Products
CVE-2025-61624Fortinet Multiple Products Path Traversal VulnerabilityFortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - Fortinet FortiMail
CVE-2026-104286Fortinet FortiMail Path Traversal VulnerabilityFortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - Fortinet Multiple Products
CVE-2025-25249Fortinet Multiple Products Heap-based Buffer Overflow VulnerabilityFortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - Fortinet FortiOS
CVE-2025-68686Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor VulnerabilityFortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - Fortinet FortiSandbox
CVE-2026-39808Fortinet FortiSandbox OS Command Injection VulnerabilityFortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - Fortinet FortiSandbox
CVE-2026-25089Fortinet FortiSandbox OS Command Injection VulnerabilityFortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - Fortinet FortiClient EMS
CVE-2026-21643Fortinet FortiClient EMS SQL Injection VulnerabilityFortinet FortiClient EMS contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Fortinet FortiClient EMS
CVE-2026-35616Fortinet FortiClient EMS Improper Access Control VulnerabilityFortinet FortiClient EMS contains an improper access control vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Fortinet Multiple Products
CVE-2026-24858Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel VulnerabilityFortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authentication bypass using an alternate path or channel that could allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Fortinet Multiple Products
CVE-2025-59718Fortinet Multiple Products Improper Verification of Cryptographic Signature VulnerabilityFortinet FortiOS, FortiSwitchMaster, FortiProxy, and FortiWeb contain an improper verification of cryptographic signature vulnerability that may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML message. Please be aware that CVE-2025-59719 pertains to the same problem and is mentioned in the same vendor advisory. Ensure to apply all patches mentioned in the advisory.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Fortinet FortiWeb
CVE-2025-58034Fortinet FortiWeb OS Command Injection VulnerabilityFortinet FortiWeb contains an OS command Injection vulnerability that may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Fortinet FortiWeb
CVE-2025-64446Fortinet FortiWeb Path Traversal VulnerabilityFortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Fortinet FortiWeb
CVE-2025-25257Fortinet FortiWeb SQL Injection VulnerabilityFortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Fortinet FortiOS
CVE-2019-6693Fortinet FortiOS Use of Hard-Coded Credentials VulnerabilityFortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Fortinet Multiple Products
CVE-2025-32756Fortinet Multiple Products Stack-Based Buffer Overflow VulnerabilityFortinet FortiFone, FortiVoice, FortiNDR and FortiMail contain a stack-based overflow vulnerability that may allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted HTTP requests.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Fortinet FortiOS and FortiProxy
CVE-2025-24472Fortinet FortiOS and FortiProxy Authentication Bypass VulnerabilityFortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Fortinet FortiOS and FortiProxy
CVE-2024-55591Fortinet FortiOS and FortiProxy Authentication Bypass VulnerabilityFortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that may allow an unauthenticated, remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Fortinet FortiManager
CVE-2024-47575Fortinet FortiManager Missing Authentication VulnerabilityFortinet FortiManager contains a missing authentication vulnerability in the fgfmd daemon that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Fortinet Multiple Products
CVE-2024-23113Fortinet Multiple Products Format String VulnerabilityFortinet FortiOS, FortiPAM, FortiProxy, and FortiWeb contain a format string vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Fortinet FortiClient EMS
CVE-2023-48788Fortinet FortiClient EMS SQL Injection VulnerabilityFortinet FortiClient EMS contains a SQL injection vulnerability that allows an unauthenticated attacker to execute commands as SYSTEM via specifically crafted requests.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Fortinet FortiOS
CVE-2024-21762Fortinet FortiOS Out-of-Bound Write VulnerabilityFortinet FortiOS contains an out-of-bound write vulnerability that allows a remote unauthenticated attacker to execute code or commands via specially crafted HTTP requests.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Fortinet FortiOS and FortiProxy SSL-VPN
CVE-2023-27997Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow VulnerabilityFortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests.CISA’s required actionApply updates per vendor instructions. - Fortinet FortiOS
CVE-2022-41328Fortinet FortiOS Path Traversal VulnerabilityFortinet FortiOS contains a path traversal vulnerability that may allow a local privileged attacker to read and write files via crafted CLI commands.CISA’s required actionApply updates per vendor instructions. - Fortinet FortiOS
CVE-2022-42475Fortinet FortiOS Heap-Based Buffer Overflow VulnerabilityMultiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.CISA’s required actionApply updates per vendor instructions. - Fortinet Multiple Products
CVE-2022-40684Fortinet Multiple Products Authentication Bypass VulnerabilityFortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.CISA’s required actionApply updates per vendor instructions. - Fortinet FortiOS and FortiADC
CVE-2018-13374Fortinet FortiOS and FortiADC Improper Access Control VulnerabilityFortinet FortiOS and FortiADC contain an improper access control vulnerability that allows attackers to obtain the LDAP server login credentials configured in FortiGate by pointing a LDAP server connectivity test request to a rogue LDAP server.CISA’s required actionApply updates per vendor instructions. - Fortinet FortiOS and FortiProxy
CVE-2018-13383Fortinet FortiOS and FortiProxy Out-of-bounds WriteA heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users.CISA’s required actionApply updates per vendor instructions. - Fortinet FortiOS and FortiProxy
CVE-2018-13382Fortinet FortiOS and FortiProxy Improper AuthorizationAn Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password.CISA’s required actionApply updates per vendor instructions. - Fortinet FortiOS
CVE-2021-44168Fortinet FortiOS Arbitrary File DownloadFortinet FortiOS "execute restore src-vis" downloads code without integrity checking, allowing an attacker to arbitrarily download files.CISA’s required actionApply updates per vendor instructions. - Fortinet FortiOS
CVE-2020-12812Fortinet FortiOS SSL VPN Improper Authentication VulnerabilityFortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to login successfully without being prompted for the second factor of authentication (FortiToken) if they change the case in their username.CISA’s required actionApply updates per vendor instructions. - Fortinet FortiOS
CVE-2019-5591Fortinet FortiOS Default Configuration VulnerabilityFortinet FortiOS contains a default configuration vulnerability that may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the Lightweight Directory Access Protocol (LDAP) server.CISA’s required actionApply updates per vendor instructions. - Fortinet FortiOS
CVE-2018-13379Fortinet FortiOS SSL VPN Path Traversal VulnerabilityFortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests.CISA’s required actionApply updates per vendor instructions.
From CISA’s Known Exploited Vulnerabilities catalog, updated 21 Oct 2026 (version 2026.10.21). CISA’s required actions are written for US government agencies. Fortinet on CISA’s site.