fortinet security advisories
35 threat alerts tracking vulnerabilities and security advisories that affect fortinet products.
Vulnios monitors fortinet CVE feeds, vendor advisories, CISA KEV listings, and exploit-prediction data continuously. Each alert below is enriched with severity, exploitation status, affected products, and a remediation path. Use this page to scan recent fortinet security news in one place, or click into an individual alert for full detail.
Critical Vulnerability: CVE-2026-44277 — fortinet — fortiauthenticator
A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthenticator 6.5.0 through 6.5.6 may allow attacke
criticalCVE-2026-44277Critical Vulnerability: CVE-2024-21762 — fortinet — fortiproxy, fortios
A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.13, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, Fort
criticalCVE-2024-21762Critical Vulnerability: CVE-2023-47534 — fortinet — forticlient_endpoint_management_server
A improper neutralization of formula elements in a csv file vulnerability in Fortinet FortiClientEMS 7.2.0 through 7.2.2, FortiClientEMS 7.0.0 through 7.0.10, FortiClientEMS 6.4 all versions, FortiCli
criticalCVE-2023-47534Critical Vulnerability: CVE-2020-12812 — fortinet — fortios
An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second facto
criticalCVE-2020-12812Critical Vulnerability: CVE-2026-26035 — fortinet — fortiweb
An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11, FortiWeb 7.2.0 through 7.2.12, F
criticalCVE-2026-26035Critical Vulnerability: CVE-2025-25256 — fortinet — fortisiem
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSIEM 7.3.0 through 7.3.1, FortiSIEM 7.2.0 through 7.
criticalCVE-2025-25256Critical Vulnerability: CVE-2026-26083 — fortinet — fortisandbox, fortisandbox_cloud
A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through 5.0.5, FortiSandbox PaaS 23.4 all versions, Forti
criticalCVE-2026-26083Critical Vulnerability: CVE-2023-42789 — fortinet — fortiproxy, fortios
A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, Fort
criticalCVE-2023-42789Critical Vulnerability: CVE-2021-32588 — fortinet — fortiportal
A use of hard-coded credentials (CWE-798) vulnerability in FortiPortal versions 5.2.5 and below, 5.3.5 and below, 6.0.4 and below, versions 5.1.x and 5.0.x may allow a remote and unauthenticated attac
criticalCVE-2021-32588Critical Vulnerability: CVE-2021-32590 — fortinet — fortiportal
Multiple improper neutralization of special elements used in an SQL command vulnerabilities in FortiPortal 6.0.0 through 6.0.4, 5.3.0 through 5.3.5, 5.2.0 through 5.2.5, and 4.2.2 and earlier may allo
criticalCVE-2021-32590Critical Vulnerability: CVE-2021-24007 — fortinet — fortimail
Multiple improper neutralization of special elements of SQL commands vulnerabilities in FortiMail before 6.4.4 may allow a non-authenticated attacker to execute unauthorized code or commands via speci
criticalCVE-2021-24007Critical Vulnerability: CVE-2020-6649 — fortinet — fortiisolator
An insufficient session expiration vulnerability in FortiNet's FortiIsolator version 2.0.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, shoul
criticalCVE-2020-6649Critical Vulnerability: CVE-2020-29015 — fortinet — fortiweb
A blind SQL injection in the user interface of FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to execute arbitrary SQL queries or commands by sendi
criticalCVE-2020-29015Critical Vulnerability: CVE-2020-29016 — fortinet — fortiweb
A stack-based buffer overflow vulnerability in FortiWeb 6.3.0 through 6.3.5 and version before 6.2.4 may allow an unauthenticated, remote attacker to overwrite the content of the stack and potentially
criticalCVE-2020-29016Critical Vulnerability: CVE-2020-9292 — fortinet — fortisiem_windows_agent
An unquoted service path vulnerability in the FortiSIEM Windows Agent component may allow an attacker to gain elevated privileges via the AoWinAgt executable service path.
criticalCVE-2020-9292Critical Vulnerability: CVE-2020-9294 — fortinet — fortimail, fortivoice
An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 and earlier and FortiVoiceEntreprise 6.0.0 and 6.0.1 may allow a remote unauthenticated attacker to access the system as a le
criticalCVE-2020-9294Critical Vulnerability: CVE-2019-17658 — fortinet — forticlient
An unquoted service path vulnerability in the FortiClient FortiTray component of FortiClientWindows v6.2.2 and prior allow an attacker to gain elevated privileges via the FortiClientConsole executable
criticalCVE-2019-17658Critical Vulnerability: CVE-2015-3613 — fortinet — fortimanager
A vulnerability exists in in FortiManager 5.2.1 and earlier and 5.0.10 and earlier in the WebUI FTP backup page
criticalCVE-2015-3613Critical Vulnerability: CVE-2019-16153 — fortinet — fortisiem
A hard-coded password vulnerability in the Fortinet FortiSIEM database component version 5.2.5 and below may allow attackers to access the device database via the use of static credentials.
criticalCVE-2019-16153Critical Vulnerability: CVE-2019-6698 — fortinet — fortirecorder_firmware, fortirecorder_100d
Use of Hard-coded Credentials vulnerability in FortiRecorder all versions below 2.7.4 may allow an unauthenticated attacker with knowledge of the aforementioned credentials and network access to Forti
criticalCVE-2019-6698Critical Vulnerability: CVE-2019-6695 — fortinet — fortimanager
Lack of root file system integrity checking in Fortinet FortiManager VM application images of 6.2.0, 6.0.6 and below may allow an attacker to implant third-party programs by recreating the image throu
criticalCVE-2019-6695Critical Vulnerability: CVE-2019-13400 — fortinet — fcm-mb40_firmware, fcm-mb40
Dynacolor FCM-MB40 v1.2.0.0 use /etc/appWeb/appweb.pass to store administrative web-interface credentials in cleartext. These credentials can be retrieved via cgi-bin/getuserinfo.cgi?mode=info.
criticalCVE-2019-13400Critical Vulnerability: CVE-2017-7342 — fortinet — fortiportal
A weak password recovery process vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to execute unauthorized code or commands via a hidden Close button
criticalCVE-2017-7342Critical Vulnerability: CVE-2018-1352 — fortinet — fortios
A format string vulnerability in Fortinet FortiOS 5.6.0 allows attacker to execute unauthorized code or commands via the SSH username variable.
criticalCVE-2018-1352Critical Vulnerability: CVE-2017-17540 — fortinet — fortiwlc
The presence of a hardcoded account in Fortinet FortiWLC 8.3.3 allows attackers to gain unauthorized read/write access via a remote shell.
criticalCVE-2017-17540Critical Vulnerability: CVE-2017-17539 — fortinet — fortiwlc
The presence of a hardcoded account in Fortinet FortiWLC 7.0.11 and earlier allows attackers to gain unauthorized read/write access via a remote shell.
criticalCVE-2017-17539Critical Vulnerability: CVE-2017-14189 — fortinet — fortiweb_manager
An improper access control vulnerability in Fortinet FortiWebManager 5.8.0 allows anyone that can access the admin webUI to successfully log-in regardless the provided password.
criticalCVE-2017-14189Critical Vulnerability: CVE-2015-3616 — fortinet — fortimanager_firmware, fortimanager_2000e
SQL injection vulnerability in Fortinet FortiManager 5.0.x before 5.0.11, 5.2.x before 5.2.2 allows remote attackers to execute arbitrary commands via unspecified parameters.
criticalCVE-2015-3616Critical Vulnerability: CVE-2017-7336 — fortinet — fortiwlm
A hard-coded account named 'upgrade' in Fortinet FortiWLM 8.3.0 and lower versions allows a remote attacker to log-in and execute commands with 'upgrade' account privileges.
criticalCVE-2017-7336Critical Vulnerability: CVE-2017-7337 — fortinet — fortiportal
An improper Access Control vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to interact with unauthorized VDOMs or enumerate other ADOMs via another user's stolen sess
criticalCVE-2017-7337Critical Vulnerability: CVE-2016-8491 — fortinet — fortiwlc
The presence of a hardcoded account named 'core' in Fortinet FortiWLC allows attackers to gain unauthorized read/write access via a remote shell.
criticalCVE-2016-8491Critical Vulnerability: CVE-2016-7560 — fortinet — fortiwlc
The rsyncd server in Fortinet FortiWLC 6.1-2-29 and earlier, 7.0-9-1, 7.0-10-0, 8.0-5-0, 8.1-2-0, and 8.2-4-0 has a hardcoded rsync account, which allows remote attackers to read or write to arbitrary
criticalCVE-2016-7560Critical Vulnerability: CVE-2016-4573 — fortinet — fortiswitch, fsw-1024d
Fortinet FortiSwitch FSW-108D-POE, FSW-124D, FSW-124D-POE, FSW-224D-POE, FSW-224D-FPOE, FSW-248D-POE, FSW-248D-FPOE, FSW-424D, FSW-424D-POE, FSW-424D-FPOE, FSW-448D, FSW-448D-POE, FSW-448D-FPOE, FSW-5
criticalCVE-2016-4573Critical Vulnerability: CVE-2016-6909 — fortinet — fortios, fortiswitch
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9 and FortiSwitch before 3.4.3 allows remote attackers to execute arbitrary code v
criticalCVE-2016-6909Critical Vulnerability: CVE-2016-1909 — fortinet — fortios
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0.8; and FortiOS 4.1.x before 4.1.11, 4.2.x before 4.2.16, 4.3.x before 4.3.17 an
criticalCVE-2016-1909
Track fortinet exposure across your environment
Vulnios automatically cross-references your asset inventory against new fortinet CVEs and surfaces only what affects you. No more sifting manually — actionable findings only.
Start a free scan