5 actively exploited
FortiGate 6.0.5 and below: known CVEs & fixed releases
43 CVEs affect this build · 5 in CISA KEV (actively exploited) · highest CVSS 9.8 · 11 builds behind the latest 6.0.18 · updated 2026-06-26
Patch path: upgrade to 5.6.13 or 6.0.11 or 6.0.15 or 6.0.16 or 6.0.17 or 6.0.18 or 6.0.7 or 6.0.9 or 6.2.11 or 6.2.12 or 6.2.13 or 6.2.14 or 6.2.15 or 6.2.16 or 6.2.17 or 6.2.2 or 6.2.5 or 6.4.* or 6.4.10 or 6.4.11 or 6.4.12 or 6.4.13 or 6.4.15 or 6.4.16 or 6.4.2 or 6.4.9 or 7.0.10 or 7.0.11 or 7.0.12 or 7.0.13 or 7.0.14 or 7.0.15 or 7.0.16 or 7.0.4 or 7.0.6 or 7.0.8 or 7.0.9 or 7.2.1 or 7.2.12 or 7.2.3 or 7.2.4 or 7.2.5 or 7.2.6 or 7.2.7 or 7.2.8 or 7.2.9 or 7.4.2 or 7.4.3 or 7.4.4 or 7.4.5 or 7.4.9 or 7.6.4 to clear the exploited issues below.
- KEV · exploited CRITICALCVE-2022-42475
Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability
Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.
- CVSS
- 9.8
- EPSS
- 99%
- KEV added
- 2022-12-13
- Published
- 2022-12-13
Fixed in6.0.15,6.0.16,6.2.12,6.4.10,6.4.11,7.0.8,7.0.9,7.2.3NVD ↗CISA ↗fortiguard.com ↗ - KEV · exploited CRITICALCVE-2023-27997
Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability
Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests.
- CVSS
- 9.8
- EPSS
- 86%
- KEV added
- 2023-06-13
- Published
- 2023-06-13
- KEV · exploited CRITICALCVE-2024-21762
Fortinet FortiOS Out-of-Bound Write Vulnerability
Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remote unauthenticated attacker to execute code or commands via specially crafted HTTP requests.
- CVSS
- 9.8
- EPSS
- 81%
- KEV added
- 2024-02-09
- Published
- 2024-02-09
Fixed in6.0.18,6.2.16,6.4.15,7.0.14,7.2.7,7.4.3NVD ↗CISA ↗fortiguard.com ↗ - KEV · exploited HIGHCVE-2022-41328
Fortinet FortiOS Path Traversal Vulnerability
Fortinet FortiOS contains a path traversal vulnerability that may allow a local privileged attacker to read and write files via crafted CLI commands.
- CVSS
- 7.1
- EPSS
- 12%
- KEV added
- 2023-03-14
- Published
- 2023-03-07
Fixed in6.2.14,6.4.12,7.0.10,7.2.4NVD ↗CISA ↗fortiguard.com ↗ - KEV · exploited MEDIUMCVE-2019-6693
Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability
Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key.
- CVSS
- 6.5
- EPSS
- 5%
- KEV added
- 2025-06-25
- Published
- 2019-11-21
- CRITICALCVE-2024-26011
CVE-2024-26011
A missing authentication for critical function in Fortinet FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.14, FortiPAM version 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.9, 7.0.0 through 7.0.17, 2.0.0 through 2.0.14, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7, FortiSwitchManager version 7.2.0 through 7.2.3, 7.0.0 through 7.0.3, FortiPortal version 6.0.0 through 6.0.14, FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0.0 through 7.0.14, 6.4.0 through 6.4.15, 6.2.0 through 6.2.16, 6.0.0 through 6.0.18 allows attacker to execute unauthorized code or commands via specially crafted packets.
- CVSS
- 9.8
- Published
- 2024-11-12
Fixed in7.0.15,7.2.8,7.4.4NVD ↗fortiguard.fortinet.com ↗ - CRITICALCVE-2023-25610
CVE-2023-25610
A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.6, version 6.4.0 through 6.4.11 and version 6.2.12 and below, FortiProxy version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.8, version 2.0.12 and below and FortiOS-6K7K version 7.0.5, version 6.4.0 through 6.4.10 and version 6.2.0 through 6.2.10 and below allows a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.
- CVSS
- 9.8
- Published
- 2025-03-24
Fixed in6.2.13,6.4.12,7.0.10,7.2.4NVD ↗fortiguard.com ↗ - HIGHCVE-2023-36639
CVE-2023-36639
A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, FortiOS versions 7.4.0, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiPAM versions 1.0.0 through 1.0.3 allows attacker to execute unauthorized code or commands via specially crafted API requests.
- CVSS
- 8.8
- Published
- 2023-12-13
- HIGHCVE-2020-12820
CVE-2020-12820
Under non-default configuration, a stack-based buffer overflow in FortiOS version 6.0.10 and below, version 5.6.12 and below may allow a remote attacker authenticated to the SSL VPN to crash the FortiClient NAC daemon (fcnacd) and potentially execute arbitrary code via requesting a large FortiClient file name. We are not aware of proof of concept code successfully achieving the latter.
- CVSS
- 8.8
- Published
- 2024-12-19
Fixed in5.6.13,6.0.11NVD ↗fortiguard.fortinet.com ↗ - HIGHCVE-2023-22640
CVE-2023-22640
A out-of-bounds write in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.10, FortiOS version 6.4.0 through 6.4.11, FortiOS version 6.2.0 through 6.2.13, FortiOS all versions 6.0, FortiProxy version 7.2.0 through 7.2.1, FortiProxy version 7.0.0 through 7.0.7, FortiProxy all versions 2.0, FortiProxy all versions 1.2, FortiProxy all versions 1.1, FortiProxy all versions 1.0 allows an authenticated attacker to execute unauthorized code or commands via specifically crafted requests.
- CVSS
- 8.8
- Published
- 2023-05-03
Fixed in6.2.14,6.4.12,7.0.11,7.2.4NVD ↗fortiguard.com ↗ - HIGHCVE-2023-29181
CVE-2023-29181
A use of externally-controlled format string in Fortinet FortiOS 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.14, 6.0.0 through 6.0.16, FortiProxy 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, 2.0.0 through 2.0.12, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7, FortiPAM 1.0.0 through 1.0.3 allows attacker to execute unauthorized code or commands via specially crafted command.
- CVSS
- 8.8
- Published
- 2024-02-22
Fixed in6.2.15,6.4.13,7.0.12,7.2.5NVD ↗fortiguard.com ↗ - HIGHCVE-2025-53844
CVE-2025-53844
A out-of-bounds write vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11 allows attacker to execute unauthorized code or commands via specially crafted packets.
- CVSS
- 8.8
- Published
- 2026-05-12
Fixed in7.2.12,7.4.9,7.6.4NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗ - HIGHCVE-2023-41677
CVE-2023-41677
A insufficiently protected credentials in Fortinet FortiProxy 7.4.0, 7.2.0 through 7.2.6, 7.0.0 through 7.0.12, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7, Fortinet FortiOS 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17 allows attacker to execute unauthorized code or commands via targeted social engineering attack
- CVSS
- 8.8
- Published
- 2024-04-09
Fixed in6.2.16,6.4.15,7.0.13,7.2.7,7.4.2NVD ↗fortiguard.com ↗ - HIGHCVE-2024-26009
CVE-2024-26009
An authentication bypass using an alternate path or channel [CWE-288] vulnerability in Fortinet FortiOS 6.4.0 through 6.4.15, FortiOS 6.2.0 through 6.2.16, FortiOS 6.0 all versions, FortiPAM 1.2.0, FortiPAM 1.1.0 through 1.1.2, FortiPAM 1.0.0 through 1.0.3, FortiProxy 7.4.0 through 7.4.2, FortiProxy 7.2.0 through 7.2.8, FortiProxy 7.0.0 through 7.0.15, FortiSwitchManager 7.2.0 through 7.2.3, FortiSwitchManager 7.0.0 through 7.0.3 allows an unauthenticated attacker to seize control of a managed device via crafted FGFM requests, if the device is managed by a FortiManager, and if the attacker knows that FortiManager's serial number.
- CVSS
- 8.1
- Published
- 2025-08-12
Fixed in6.2.17,6.4.16NVD ↗fortiguard.fortinet.com ↗ - HIGHCVE-2024-23110
CVE-2024-23110
A stack-based buffer overflow in Fortinet FortiOS version 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0 all versions allows attacker to execute unauthorized code or commands via specially crafted commands
- CVSS
- 7.8
- Published
- 2024-06-11
Fixed in6.2.16,6.4.15,7.0.14,7.2.7,7.4.3NVD ↗fortiguard.com ↗ - HIGHCVE-2023-22639
CVE-2023-22639
A out-of-bounds write in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.10, FortiOS version 6.4.0 through 6.4.12, FortiOS all versions 6.2, FortiOS all versions 6.0, FortiProxy version 7.2.0 through 7.2.2, FortiProxy version 7.0.0 through 7.0.8, FortiProxy all versions 2.0, FortiProxy all versions 1.2, FortiProxy all versions 1.1, FortiProxy all versions 1.0 allows attacker to escalation of privilege via specifically crafted commands.
- CVSS
- 7.8
- Published
- 2023-06-13
- HIGHCVE-2024-26010
CVE-2024-26010
A stack-based buffer overflow in Fortinet FortiPAM version 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiWeb, FortiAuthenticator, FortiSwitchManager version 7.2.0 through 7.2.3, 7.0.1 through 7.0.3, FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0.0 through 7.0.14, 6.4.0 through 6.4.15, 6.2.0 through 6.2.16, 6.0.0 through 6.0.18, FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.9, 7.0.0 through 7.0.15, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7 allows attacker to execute unauthorized code or commands via specially crafted packets.
- CVSS
- 7.5
- Published
- 2024-06-11
Fixed in7.0.15,7.2.8,7.4.4NVD ↗fortiguard.fortinet.com ↗ - HIGHCVE-2020-12819
CVE-2020-12819
A heap-based buffer overflow vulnerability in the processing of Link Control Protocol messages in FortiGate versions 5.6.12, 6.0.10, 6.2.4 and 6.4.1 and earlier may allow a remote attacker with valid SSL VPN credentials to crash the SSL VPN daemon by sending a large LCP packet, when tunnel mode is enabled. Arbitrary code execution may be theoretically possible, albeit practically very difficult to achieve in this context
- CVSS
- 7.5
- Published
- 2024-12-19
Fixed in5.6.13,6.0.11,6.2.5,6.4.2NVD ↗fortiguard.com ↗ - HIGHCVE-2023-29180
CVE-2023-29180
A null pointer dereference in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.14, 6.0.0 through 6.0.16, FortiProxy 7.2.0 through 7.2.3, 7.0.0 through 7.0.10, 2.0.0 through 2.0.12, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7 allows attacker to denial of service via specially crafted HTTP requests.
- CVSS
- 7.5
- Published
- 2024-02-22
Fixed in6.0.17,6.2.15,6.4.13,7.0.12,7.2.5NVD ↗fortiguard.com ↗ - HIGHCVE-2025-58413
CVE-2025-58413
A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiSASE 25.3.b allows attacker to execute unauthorized code or commands via specially crafted packets
- CVSS
- 7.5
- Published
- 2025-11-18
Fixed in7.4.9,7.6.4NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗ - HIGHCVE-2022-39948
CVE-2022-39948
An improper certificate validation vulnerability [CWE-295] in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.7, 6.4 all versions, 6.2 all versions, 6.0 all versions and FortiProxy 7.0.0 through 7.0.6, 2.0 all versions, 1.2 all versions may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the FortiOS/FortiProxy device and remote servers hosting threat feeds (when the latter are configured as Fabric connectors in FortiOS/FortiProxy)
- CVSS
- 7.4
- Published
- 2023-02-16
Fixed in7.0.8,7.2.4NVD ↗fortiguard.com ↗ - HIGHCVE-2023-45583
CVE-2023-45583
A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0.0 through 6.0.16, FortiPAM 1.1.0, FortiPAM 1.0 all versions, FortiProxy 7.2.0 through 7.2.5, FortiProxy 7.0.0 through 7.0.11, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1 all versions, FortiProxy 1.0 all versions, FortiSwitchManager 7.2.0 through 7.2.2, FortiSwitchManager 7.0.0 through 7.0.2 allows attacker to execute unauthorized code or commands via specially crafted cli commands and http requests.
- CVSS
- 7.2
- Published
- 2024-05-14
Fixed in7.2.6NVD ↗fortiguard.com ↗ - MEDIUMCVE-2023-28002
CVE-2023-28002
An improper validation of integrity check value vulnerability [CWE-354] in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.12, 6.4 all versions, 6.2 all versions, 6.0 all versions and VMs may allow a local attacker with admin privileges to boot a malicious image on the device and bypass the filesystem integrity check in place.
- CVSS
- 6.7
- Published
- 2023-11-14
- MEDIUMCVE-2021-43072
CVE-2021-43072
A buffer copy without checking size of input ('classic buffer overflow') in Fortinet FortiAnalyzer version 7.0.2 and below, version 6.4.7 and below, version 6.2.9 and below, version 6.0.11 and below, version 5.6.11 and below, FortiManager version 7.0.2 and below, version 6.4.7 and below, version 6.2.9 and below, version 6.0.11 and below, version 5.6.11 and below, FortiOS version 7.0.0 through 7.0.4, 6.4.0 through 6.4.8, 6.2.0 through 6.2.10, 6.0.x and FortiProxy version 7.0.0 through 7.0.3, 2.0.0 through 2.0.8, 1.2.x, 1.1.x and 1.0.x allows attacker to execute unauthorized code or commands via crafted CLI `execute restore image` and `execute certificate remote` operations with the tFTP protocol.
- CVSS
- 6.7
- Published
- 2023-07-18
Fixed in6.2.11,6.4.9,7.0.6NVD ↗fortiguard.com ↗ - MEDIUMCVE-2023-36640
CVE-2023-36640
A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0.0 through 6.0.16, FortiPAM 1.1.0, FortiPAM 1.0 all versions, FortiProxy 7.2.0 through 7.2.5, FortiProxy 7.0.0 through 7.0.11, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1 all versions, FortiProxy 1.0 all versions allows attacker to execute unauthorized code or commands via specially crafted commands
- CVSS
- 6.7
- Published
- 2024-05-14
- MEDIUMCVE-2023-33305
CVE-2023-33305
A loop with unreachable exit condition ('infinite loop') in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS version 7.0.0 through 7.0.10, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiProxy version 7.2.0 through 7.2.3, FortiProxy version 7.0.0 through 7.0.9, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1 all versions, FortiProxy 1.0 all versions, FortiWeb version 7.2.0 through 7.2.1, FortiWeb version 7.0.0 through 7.0.6, FortiWeb 6.4 all versions, FortiWeb 6.3 all versions allows attacker to perform a denial of service via specially crafted HTTP requests.
- CVSS
- 6.5
- Published
- 2023-06-13
- MEDIUMCVE-2023-42786
CVE-2023-42786
A null pointer dereference in FortiOS versions 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0 all versions, 6.4 all versions , 6.2 all versions and 6.0 all versions allows attacker to trigger a denial of service via a crafted http request.
- CVSS
- 6.5
- Published
- 2025-01-14
Fixed in7.2.6,7.4.2NVD ↗fortiguard.fortinet.com ↗ - MEDIUMCVE-2023-36641
CVE-2023-36641
A numeric truncation error in Fortinet FortiProxy version 7.2.0 through 7.2.4, FortiProxy version 7.0.0 through 7.0.10, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1, all versions, FortiProxy 1.0 all versions, FortiOS version 7.4.0, FortiOS version 7.2.0 through 7.2.5, FortiOS version 7.0.0 through 7.0.12, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions allows attacker to denial of service via specifically crafted HTTP requests.
- CVSS
- 6.5
- Published
- 2023-11-14
- MEDIUMCVE-2023-42785
CVE-2023-42785
A null pointer dereference in FortiOS versions 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0 all versions, 6.4 all versions , 6.2 all versions and 6.0 all versions allows attacker to trigger a denial of service via a crafted http request.
- CVSS
- 6.5
- Published
- 2025-01-14
Fixed in7.2.6,7.4.2NVD ↗fortiguard.fortinet.com ↗ - MEDIUMCVE-2022-23439
CVE-2022-23439
A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafted HTTP requests, where the `Host` header points to an arbitrary webserver
- CVSS
- 6.1
- Published
- 2025-01-22
Fixed in6.4.*,7.0.6,7.2.5NVD ↗fortiguard.com ↗ - MEDIUMCVE-2019-6697
CVE-2019-6697
An Improper Neutralization of Input vulnerability affecting FortiGate version 6.2.0 through 6.2.1, 6.0.0 through 6.0.6 in the hostname parameter of a DHCP packet under DHCP monitor page may allow an unauthenticated attacker in the same network as the FortiGate to perform a Stored Cross Site Scripting attack (XSS) by sending a crafted DHCP packet.
- CVSS
- 6.1
- Published
- 2025-03-17
Fixed in6.0.7,6.2.2NVD ↗fortiguard.com ↗ - MEDIUMCVE-2022-38378
CVE-2022-38378
An improper privilege management vulnerability [CWE-269] in Fortinet FortiOS version 7.2.0 and before 7.0.7 and FortiProxy version 7.2.0 through 7.2.1 and before 7.0.7 allows an attacker that has access to the admin profile section (System subsection Administrator Users) to modify their own profile and upgrade their privileges to Read Write via CLI or GUI commands.
- CVSS
- 6
- Published
- 2023-02-16
Fixed in7.0.8,7.2.1NVD ↗fortiguard.com ↗ - MEDIUMCVE-2022-42472
CVE-2022-42472
A improper neutralization of crlf sequences in http headers ('http response splitting') in Fortinet FortiOS versions 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.11, 6.2.0 through 6.2.12, 6.0.0 through 6.0.16, FortiProxy 7.2.0 through 7.2.1, 7.0.0 through 7.0.7, 2.0.0 through 2.0.10, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6 may allow an authenticated and remote attacker to perform an HTTP request splitting attack which gives attackers control of the remaining headers and body of the response.
- CVSS
- 5.4
- Published
- 2023-02-16
- MEDIUMCVE-2023-22641
CVE-2023-22641
A url redirection to untrusted site ('open redirect') in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.9, FortiOS versions 6.4.0 through 6.4.12, FortiOS all versions 6.2, FortiOS all versions 6.0, FortiProxy version 7.2.0 through 7.2.2, FortiProxy version 7.0.0 through 7.0.8, FortiProxy all versions 2.0, FortiProxy all versions 1.2, FortiProxy all versions 1.1, FortiProxy all versions 1.0 allows an authenticated attacker to execute unauthorized code or commands via specially crafted requests.
- CVSS
- 5.4
- Published
- 2023-04-11
Fixed in6.4.13,7.0.11,7.2.4NVD ↗fortiguard.com ↗ - MEDIUMCVE-2019-15706
CVE-2019-15706
An improper neutralization of input during web page generation in the SSL VPN portal of FortiProxy version 2.0.0, version 1.2.9 and below and FortiOS version 6.2.1 and below, version 6.0.8 and below, version 5.6.12 may allow a remote authenticated attacker to perform a stored cross site scripting attack (XSS).
- CVSS
- 5.4
- Published
- 2025-03-17
Fixed in5.6.13,6.0.9,6.2.2NVD ↗fortiguard.fortinet.com ↗ - MEDIUMCVE-2020-29010
CVE-2020-29010
An exposure of sensitive information to an unauthorized actor vulnerability in FortiOS version 6.2.4 and below, version 6.0.10 and belowmay allow remote authenticated actors to read the SSL VPN events log entries of users in other VDOMs by executing "get vpn ssl monitor" from the CLI. The sensitive data includes usernames, user groups, and IP address.
- CVSS
- 5
- Published
- 2025-03-17
Fixed in6.0.11,6.2.5NVD ↗fortiguard.fortinet.com ↗ - MEDIUMCVE-2023-29175
CVE-2023-29175
An improper certificate validation vulnerability [CWE-295] in FortiOS 6.2 all versions, 6.4 all versions, 7.0.0 through 7.0.10, 7.2.0 and FortiProxy 1.2 all versions, 2.0 all versions, 7.0.0 through 7.0.9, 7.2.0 through 7.2.3 may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the vulnerable device and the remote FortiGuard's map server.
- CVSS
- 4.8
- Published
- 2023-06-13
Fixed in7.0.11NVD ↗fortiguard.com ↗ - MEDIUMCVE-2023-29178
CVE-2023-29178
A access of uninitialized pointer vulnerability [CWE-824] in Fortinet FortiProxy version 7.2.0 through 7.2.3 and before 7.0.9 and FortiOS version 7.2.0 through 7.2.4 and before 7.0.11 allows an authenticated attacker to repetitively crash the httpsd process via crafted HTTP or HTTPS requests.
- CVSS
- 4.3
- Published
- 2023-06-13
- MEDIUMCVE-2021-43074
CVE-2021-43074
An improper verification of cryptographic signature vulnerability [CWE-347] in FortiWeb 6.4 all versions, 6.3.16 and below, 6.2 all versions, 6.1 all versions, 6.0 all versions; FortiOS 7.0.3 and below, 6.4.8 and below, 6.2 all versions, 6.0 all versions; FortiSwitch 7.0.3 and below, 6.4.10 and below, 6.2 all versions, 6.0 all versions; FortiProxy 7.0.1 and below, 2.0.7 and below, 1.2 all versions, 1.1 all versions, 1.0 all versions may allow an attacker to decrypt portions of the administrative session management cookie if able to intercept the latter.
- CVSS
- 4.3
- Published
- 2023-02-16
Fixed in6.4.9,7.0.4NVD ↗fortiguard.com ↗ - MEDIUMCVE-2024-47569
CVE-2024-47569
A insertion of sensitive information into sent data vulnerability in Fortinet FortiMail 7.4.0 through 7.4.2, FortiMail 7.2.0 through 7.2.6, FortiMail 7.0 all versions, FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.1 through 7.4.3, FortiManager Cloud 7.4.1 through 7.4.3, FortiNDR 7.6.0 through 7.6.1, FortiNDR 7.4.0 through 7.4.8, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions, FortiNDR 7.0 all versions, FortiNDR 1.5 all versions, FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.4, FortiOS 7.2.0 through 7.2.8, FortiOS 7.0.0 through 7.0.15, FortiOS 6.4.0 through 6.4.15, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.4.0 through 7.4.4, FortiProxy 7.2.0 through 7.2.10, FortiProxy 7.0 all versions, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1 all versions, FortiProxy 1.0 all versions, FortiRecorder 7.2.0 through 7.2.1, FortiRecorder 7.0.0 through 7.0.4, FortiTester 7.4.0 through 7.4.2, FortiTester 7.3 all versions, FortiTester 7.2 all versions, FortiTester 7.1 all versions, FortiTester 7.0 all versions, FortiTester 4.2 all versions, FortiVoice 7.0.0 through 7.0.4, FortiVoice 6.4.0 through 6.4.9, FortiVoice 6.0.7 through 6.0.12, FortiWeb 7.6.0, FortiWeb 7.4.0 through 7.4.4, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions, FortiWeb 6.4 all versions allows attacker to disclose sensitive information via specially crafted packets.
- CVSS
- 4.3
- Published
- 2025-10-14
Fixed in6.4.16,7.0.16,7.2.9,7.4.5NVD ↗fortiguard.fortinet.com ↗ - MEDIUMCVE-2022-22305
CVE-2022-22305
An improper certificate validation vulnerability [CWE-295] in FortiManager 7.0.1 and below, 6.4.6 and below; FortiAnalyzer 7.0.2 and below, 6.4.7 and below; FortiOS 6.2.x and 6.0.x; FortiSandbox 4.0.x, 3.2.x and 3.1.x may allow a network adjacent and unauthenticated attacker to man-in-the-middle the communication between the listed products and some external peers.
- CVSS
- 4.2
- Published
- 2023-09-01
- LOWCVE-2022-29054
CVE-2022-29054
A missing cryptographic steps vulnerability [CWE-325] in the functions that encrypt the DHCP and DNS keys in Fortinet FortiOS version 7.2.0, 7.0.0 through 7.0.5, 6.4.0 through 6.4.9, 6.2.x and 6.0.x may allow an attacker in possession of the encrypted key to decipher it.
- CVSS
- 3.3
- Published
- 2023-02-16
Fixed in7.0.8NVD ↗fortiguard.com ↗ - LOWCVE-2022-22302
CVE-2022-22302
A clear text storage of sensitive information (CWE-312) vulnerability in both FortiGate version 6.4.0 through 6.4.1, 6.2.0 through 6.2.9 and 6.0.0 through 6.0.13 and FortiAuthenticator version 5.5.0 and all versions of 6.1 and 6.0 may allow a local unauthorized party to retrieve the Fortinet private keys used to establish secure communication with both Apple Push Notification and Google Cloud Messaging services, via accessing the files on the filesystem.
- CVSS
- 3.3
- Published
- 2023-07-11
Stop checking versions by hand
Is your whole fleet exposed, not just this FortiGate?
VulnMonitor reconciles every advisory against your real inventory and ranks what matters by actual exploitation (CISA KEV, EPSS), not raw CVSS. New CVE hits your gear, it is on your queue with the fix attached.
Free to start · no credit card
Other FortiGate versions
- 7.2.0 132 CVEs · 7 KEV
- 7.0.3 130 CVEs · 10 KEV
- 7.0.2 130 CVEs · 10 KEV
- 7.0.1 129 CVEs · 10 KEV
- 7.2.2 128 CVEs · 7 KEV
- 7.2.1 128 CVEs · 7 KEV
- 7.0.5 128 CVEs · 9 KEV
- 7.0.4 128 CVEs · 9 KEV
- 7.0.0 126 CVEs · 10 KEV
- 7.0.10 111 CVEs · 7 KEV
- 6.4.8 104 CVEs · 4 KEV
- 6.4.6 102 CVEs · 4 KEV
- 6.4.10 101 CVEs · 3 KEV
- 6.4.1 101 CVEs · 4 KEV