3 actively exploited
FortiGate 6.4.10: known CVEs & fixed releases
101 CVEs affect this build · 3 in CISA KEV (actively exploited) · highest CVSS 9.8 · 7 builds behind the latest 6.4.17 · updated 2026-06-26
Patch path: upgrade to 6.0.17 or 6.0.18 or 6.2.13 or 6.2.14 or 6.2.15 or 6.2.16 or 6.2.17 or 6.4.12 or 6.4.13 or 6.4.15 or 6.4.16 or 6.4.17 or 7.0.10 or 7.0.11 or 7.0.12 or 7.0.13 or 7.0.14 or 7.0.15 or 7.0.16 or 7.0.17 or 7.0.18 or 7.0.4 or 7.0.8 or 7.2.1 or 7.2.10 or 7.2.11 or 7.2.12 or 7.2.4 or 7.2.5 or 7.2.6 or 7.2.7 or 7.2.8 or 7.2.9 or 7.4.1 or 7.4.10 or 7.4.2 or 7.4.3 or 7.4.4 or 7.4.5 or 7.4.6 or 7.4.7 or 7.4.8 or 7.4.9 or 7.6.2 or 7.6.3 or 7.6.4 or 7.6.5 to clear the exploited issues below.
- KEV · exploited CRITICALCVE-2023-27997
Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability
Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests.
- CVSS
- 9.8
- EPSS
- 86%
- KEV added
- 2023-06-13
- Published
- 2023-06-13
- KEV · exploited CRITICALCVE-2024-21762
Fortinet FortiOS Out-of-Bound Write Vulnerability
Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remote unauthenticated attacker to execute code or commands via specially crafted HTTP requests.
- CVSS
- 9.8
- EPSS
- 81%
- KEV added
- 2024-02-09
- Published
- 2024-02-09
Fixed in6.0.18,6.2.16,6.4.15,7.0.14,7.2.7,7.4.3NVD ↗CISA ↗fortiguard.com ↗ - KEV · exploited HIGHCVE-2022-41328
Fortinet FortiOS Path Traversal Vulnerability
Fortinet FortiOS contains a path traversal vulnerability that may allow a local privileged attacker to read and write files via crafted CLI commands.
- CVSS
- 7.1
- EPSS
- 12%
- KEV added
- 2023-03-14
- Published
- 2023-03-07
Fixed in6.2.14,6.4.12,7.0.10,7.2.4NVD ↗CISA ↗fortiguard.com ↗ - MEDIUMCVE-2025-25250
CVE-2025-25250
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiSASE 25.1.c may allow an authenticated user to access full SSL-VPN settings via crafted URL.
- CVSS
- 4.3
- EPSS
- 0%
- Published
- 2025-06-10
Fixed in7.4.8NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗ - MEDIUMCVE-2025-67862
CVE-2025-67862
An Internal Asset Exposed to Unsafe Debug Access Level or State vulnerability [CWE-1244] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.2, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2.0 through 7.2.10, FortiOS 7.0.0 through 7.0.16, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0 all versions may allow an authenticated admin to execute lua scripts via crafted CLI commands.
- CVSS
- 6.7
- EPSS
- 0%
- Published
- 2026-06-09
Fixed in7.2.11,7.4.8,7.6.3NVD ↗fortiguard.fortinet.com ↗ - MEDIUMCVE-2025-54821
CVE-2025-54821
An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.11, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.6.0, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiSASE 25.2.91 may allow an authenticated administrator to bypass the trusted host policy via crafted CLI command.
- CVSS
- 6
- EPSS
- 0%
- Published
- 2025-11-18
Fixed in7.6.4NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗ - CRITICALCVE-2024-26011
CVE-2024-26011
A missing authentication for critical function in Fortinet FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.14, FortiPAM version 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.9, 7.0.0 through 7.0.17, 2.0.0 through 2.0.14, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7, FortiSwitchManager version 7.2.0 through 7.2.3, 7.0.0 through 7.0.3, FortiPortal version 6.0.0 through 6.0.14, FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0.0 through 7.0.14, 6.4.0 through 6.4.15, 6.2.0 through 6.2.16, 6.0.0 through 6.0.18 allows attacker to execute unauthorized code or commands via specially crafted packets.
- CVSS
- 9.8
- Published
- 2024-11-12
Fixed in7.0.15,7.2.8,7.4.4NVD ↗fortiguard.fortinet.com ↗ - CRITICALCVE-2024-48886
CVE-2024-48886
A weak authentication in Fortinet FortiOS versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, FortiProxy versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.10, 7.0.0 through 7.0.17, 2.0.0 through 2.0.14, FortiManager versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiManager Cloud versions 7.4.1 through 7.4.3, FortiAnalyzer Cloud versions 7.4.1 through 7.4.3 allows attacker to execute unauthorized code or commands via a brute-force attack.
- CVSS
- 9.8
- Published
- 2025-01-14
Fixed in7.0.16,7.2.9,7.4.5NVD ↗fortiguard.fortinet.com ↗ - CRITICALCVE-2023-42789
CVE-2023-42789
A out-of-bounds write in Fortinet FortiOS 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, FortiProxy 7.4.0, 7.2.0 through 7.2.6, 7.0.0 through 7.0.12, 2.0.0 through 2.0.13 allows attacker to execute unauthorized code or commands via specially crafted HTTP requests.
- CVSS
- 9.8
- Published
- 2024-03-12
- CRITICALCVE-2025-25249
CVE-2025-25249
A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets
- CVSS
- 9.8
- Published
- 2026-01-13
Fixed in6.4.17,7.0.18,7.2.12,7.4.9,7.6.4NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗ - CRITICALCVE-2023-25610
CVE-2023-25610
A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.6, version 6.4.0 through 6.4.11 and version 6.2.12 and below, FortiProxy version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.8, version 2.0.12 and below and FortiOS-6K7K version 7.0.5, version 6.4.0 through 6.4.10 and version 6.2.0 through 6.2.10 and below allows a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.
- CVSS
- 9.8
- Published
- 2025-03-24
Fixed in6.2.13,6.4.12,7.0.10,7.2.4NVD ↗fortiguard.com ↗ - CRITICALCVE-2024-48884
CVE-2024-48884
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.1 through 7.4.3, FortiManager Cloud 7.4.1 through 7.4.3, FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.4, FortiOS 7.2.0 through 7.2.9, FortiOS 7.0.0 through 7.0.15, FortiOS 6.4.0 through 6.4.15, FortiProxy 7.4.0 through 7.4.5, FortiProxy 7.2.0 through 7.2.11, FortiProxy 7.0.0 through 7.0.18, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1 all versions, FortiProxy 1.0 all versions may allow a remote authenticated attacker with access to the security fabric interface and port to write arbitrary files or a remote unauthenticated attacker to delete an arbitrary folder
- CVSS
- 9.1
- Published
- 2025-01-14
Fixed in6.4.16,7.0.16,7.2.10,7.4.5NVD ↗fortiguard.fortinet.com ↗ - HIGHCVE-2025-57740
CVE-2025-57740
An Heap-based Buffer Overflow vulnerability [CWE-122] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions; FortiPAM version 1.5.0, version 1.4.2 and below, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions and FortiProxy version 7.6.2 and below, version 7.4.3 and below, 7.2 all versions, 7.0 all versions RDP bookmark connection may allow an authenticated user to execute unauthorized code via crafted requests.
- CVSS
- 8.8
- Published
- 2025-10-14
Fixed in7.2.11,7.4.8,7.6.3NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗ - HIGHCVE-2023-36639
CVE-2023-36639
A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, FortiOS versions 7.4.0, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiPAM versions 1.0.0 through 1.0.3 allows attacker to execute unauthorized code or commands via specially crafted API requests.
- CVSS
- 8.8
- Published
- 2023-12-13
- HIGHCVE-2023-22640
CVE-2023-22640
A out-of-bounds write in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.10, FortiOS version 6.4.0 through 6.4.11, FortiOS version 6.2.0 through 6.2.13, FortiOS all versions 6.0, FortiProxy version 7.2.0 through 7.2.1, FortiProxy version 7.0.0 through 7.0.7, FortiProxy all versions 2.0, FortiProxy all versions 1.2, FortiProxy all versions 1.1, FortiProxy all versions 1.0 allows an authenticated attacker to execute unauthorized code or commands via specifically crafted requests.
- CVSS
- 8.8
- Published
- 2023-05-03
Fixed in6.2.14,6.4.12,7.0.11,7.2.4NVD ↗fortiguard.com ↗ - HIGHCVE-2023-29181
CVE-2023-29181
A use of externally-controlled format string in Fortinet FortiOS 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.14, 6.0.0 through 6.0.16, FortiProxy 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, 2.0.0 through 2.0.12, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7, FortiPAM 1.0.0 through 1.0.3 allows attacker to execute unauthorized code or commands via specially crafted command.
- CVSS
- 8.8
- Published
- 2024-02-22
Fixed in6.2.15,6.4.13,7.0.12,7.2.5NVD ↗fortiguard.com ↗ - HIGHCVE-2025-53847
CVE-2025-53847
A missing authentication for critical function vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiOS 6.2.9 through 6.2.17 allows attacker to execute unauthorized code or commands via specially crafted packets.
- CVSS
- 8.8
- Published
- 2026-04-14
Fixed in7.0.18,7.2.12,7.4.9,7.6.4NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗ - HIGHCVE-2025-53844
CVE-2025-53844
A out-of-bounds write vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11 allows attacker to execute unauthorized code or commands via specially crafted packets.
- CVSS
- 8.8
- Published
- 2026-05-12
Fixed in7.2.12,7.4.9,7.6.4NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗ - HIGHCVE-2023-37930
CVE-2023-37930
Multiple issues including the use of uninitialized ressources [CWE-908] and excessive iteration [CWE-834] vulnerabilities vulnerability in Fortinet allows a VPN user to corrupt memory potentially leading to code or commands execution via specifically crafted requests.
- CVSS
- 8.8
- Published
- 2025-04-08
Fixed in6.4.15,7.0.13,7.2.6NVD ↗fortiguard.com ↗ - HIGHCVE-2022-45862
CVE-2022-45862
An insufficient session expiration vulnerability [CWE-613] vulnerability in FortiOS 7.2.5 and below, 7.0 all versions, 6.4 all versions; FortiProxy 7.2 all versions, 7.0 all versions; FortiPAM 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions; FortiSwitchManager 7.2.1 and below, 7.0 all versions GUI may allow attackers to re-use websessions after GUI logout, should they manage to acquire the required credentials.
- CVSS
- 8.8
- Published
- 2024-08-13
Fixed in7.2.6NVD ↗fortiguard.com ↗ - HIGHCVE-2023-41677
CVE-2023-41677
A insufficiently protected credentials in Fortinet FortiProxy 7.4.0, 7.2.0 through 7.2.6, 7.0.0 through 7.0.12, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7, Fortinet FortiOS 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17 allows attacker to execute unauthorized code or commands via targeted social engineering attack
- CVSS
- 8.8
- Published
- 2024-04-09
Fixed in6.2.16,6.4.15,7.0.13,7.2.7,7.4.2NVD ↗fortiguard.com ↗ - HIGHCVE-2022-43947
CVE-2022-43947
An improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiOS version 7.2.0 through 7.2.3 and before 7.0.10, FortiProxy version 7.2.0 through 7.2.2 and before 7.0.8 administrative interface allows an attacker with a valid user account to perform brute-force attacks on other user accounts via injecting valid login sessions.
- CVSS
- 8.8
- Published
- 2023-04-11
Fixed in6.4.13,7.0.11,7.2.4NVD ↗fortiguard.com ↗ - HIGHCVE-2022-42476
CVE-2022-42476
A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.11, FortiProxy version 7.2.0 through 7.2.2 and 7.0.0 through 7.0.8 allows privileged VDOM administrators to escalate their privileges to super admin of the box via crafted CLI requests.
- CVSS
- 8.2
- Published
- 2023-03-07
- HIGHCVE-2024-26009
CVE-2024-26009
An authentication bypass using an alternate path or channel [CWE-288] vulnerability in Fortinet FortiOS 6.4.0 through 6.4.15, FortiOS 6.2.0 through 6.2.16, FortiOS 6.0 all versions, FortiPAM 1.2.0, FortiPAM 1.1.0 through 1.1.2, FortiPAM 1.0.0 through 1.0.3, FortiProxy 7.4.0 through 7.4.2, FortiProxy 7.2.0 through 7.2.8, FortiProxy 7.0.0 through 7.0.15, FortiSwitchManager 7.2.0 through 7.2.3, FortiSwitchManager 7.0.0 through 7.0.3 allows an unauthenticated attacker to seize control of a managed device via crafted FGFM requests, if the device is managed by a FortiManager, and if the attacker knows that FortiManager's serial number.
- CVSS
- 8.1
- Published
- 2025-08-12
Fixed in6.2.17,6.4.16NVD ↗fortiguard.fortinet.com ↗ - HIGHCVE-2022-41335
CVE-2022-41335
A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.10, FortiProxy version 7.2.0 through 7.2.1, 7.0.0 through 7.0.7 and before 2.0.10, FortiSwitchManager 7.2.0 and before 7.0.0 allows an authenticated attacker to read and write files on the underlying Linux system via crafted HTTP requests.
- CVSS
- 8.1
- Published
- 2023-02-16
- HIGHCVE-2023-42790
CVE-2023-42790
A stack-based buffer overflow in Fortinet FortiOS 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, FortiProxy 7.4.0, 7.2.0 through 7.2.6, 7.0.0 through 7.0.12, 2.0.0 through 2.0.13 allows attacker to execute unauthorized code or commands via specially crafted HTTP requests.
- CVSS
- 8.1
- Published
- 2024-03-12
- HIGHCVE-2023-46718
CVE-2023-46718
A stack-based buffer overflow in Fortinet FortiOS version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.7 and 7.0.0 through 7.0.12 and 6.4.6 through 6.4.15 and 6.2.9 through 6.2.16 and 6.0.13 through 6.0.18 allows attacker to execute unauthorized code or commands via specially crafted CLI commands.
- CVSS
- 7.8
- Published
- 2025-10-14
Fixed in7.2.12,7.4.2NVD ↗fortiguard.fortinet.com ↗ - HIGHCVE-2024-23110
CVE-2024-23110
A stack-based buffer overflow in Fortinet FortiOS version 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0 all versions allows attacker to execute unauthorized code or commands via specially crafted commands
- CVSS
- 7.8
- Published
- 2024-06-11
Fixed in6.2.16,6.4.15,7.0.14,7.2.7,7.4.3NVD ↗fortiguard.com ↗ - HIGHCVE-2023-22639
CVE-2023-22639
A out-of-bounds write in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.10, FortiOS version 6.4.0 through 6.4.12, FortiOS all versions 6.2, FortiOS all versions 6.0, FortiProxy version 7.2.0 through 7.2.2, FortiProxy version 7.0.0 through 7.0.8, FortiProxy all versions 2.0, FortiProxy all versions 1.2, FortiProxy all versions 1.1, FortiProxy all versions 1.0 allows attacker to escalation of privilege via specifically crafted commands.
- CVSS
- 7.8
- Published
- 2023-06-13
- HIGHCVE-2022-43953
CVE-2022-43953
A use of externally-controlled format string in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS all versions 7.0, FortiOS all versions 6.4, FortiOS all versions 6.2, FortiProxy version 7.2.0 through 7.2.1, FortiProxy version 7.0.0 through 7.0.7 allows attacker to execute unauthorized code or commands via specially crafted commands.
- CVSS
- 7.8
- Published
- 2023-06-13
- HIGHCVE-2023-46720
CVE-2023-46720
A stack-based buffer overflow in Fortinet FortiOS version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.7 and 7.0.0 through 7.0.12 and 6.4.6 through 6.4.15 and 6.2.9 through 6.2.16 and 6.0.13 through 6.0.18 allows attacker to execute unauthorized code or commands via specially crafted CLI commands.
- CVSS
- 7.8
- Published
- 2024-06-11
Fixed in7.2.8,7.4.3NVD ↗fortiguard.fortinet.com ↗ - HIGHCVE-2024-26010
CVE-2024-26010
A stack-based buffer overflow in Fortinet FortiPAM version 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiWeb, FortiAuthenticator, FortiSwitchManager version 7.2.0 through 7.2.3, 7.0.1 through 7.0.3, FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0.0 through 7.0.14, 6.4.0 through 6.4.15, 6.2.0 through 6.2.16, 6.0.0 through 6.0.18, FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.9, 7.0.0 through 7.0.15, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7 allows attacker to execute unauthorized code or commands via specially crafted packets.
- CVSS
- 7.5
- Published
- 2024-06-11
Fixed in7.0.15,7.2.8,7.4.4NVD ↗fortiguard.fortinet.com ↗ - HIGHCVE-2025-53843
CVE-2025-53843
A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to execute unauthorized code or commands via specially crafted packets
- CVSS
- 7.5
- Published
- 2025-11-18
Fixed in7.4.9,7.6.4NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗ - HIGHCVE-2024-46668
CVE-2024-46668
An allocation of resources without limits or throttling vulnerability [CWE-770] in FortiOS versions 7.4.0 through 7.4.4, versions 7.2.0 through 7.2.8, versions 7.0.0 through 7.0.15, and versions 6.4.0 through 6.4.15 may allow an unauthenticated remote user to consume all system memory via multiple large file uploads.
- CVSS
- 7.5
- Published
- 2025-01-14
Fixed in6.4.16,7.0.16,7.2.9,7.4.5NVD ↗fortiguard.fortinet.com ↗ - HIGHCVE-2023-29180
CVE-2023-29180
A null pointer dereference in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.14, 6.0.0 through 6.0.16, FortiProxy 7.2.0 through 7.2.3, 7.0.0 through 7.0.10, 2.0.0 through 2.0.12, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7 allows attacker to denial of service via specially crafted HTTP requests.
- CVSS
- 7.5
- Published
- 2024-02-22
Fixed in6.0.17,6.2.15,6.4.13,7.0.12,7.2.5NVD ↗fortiguard.com ↗ - HIGHCVE-2024-26013
CVE-2024-26013
A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS version 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15 and before 6.2.16, Fortinet FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.9 and before 7.0.15, Fortinet FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.14 and before 6.2.13, Fortinet FortiAnalyzer version 7.4.0 through 7.4.2, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.14 and before 6.2.13, Fortinet FortiVoice version 7.0.0 through 7.0.2 before 6.4.8 and Fortinet FortiWeb before 7.4.2 may allow an unauthenticated attacker in a man-in-the-middle position to impersonate the management device (FortiCloud server or/and in certain conditions, FortiManager), via intercepting the FGFM authentication request between the management device and the managed device
- CVSS
- 7.5
- Published
- 2025-04-08
Fixed in7.0.16,7.2.9,7.4.5NVD ↗fortiguard.fortinet.com ↗ - HIGHCVE-2025-58413
CVE-2025-58413
A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiSASE 25.3.b allows attacker to execute unauthorized code or commands via specially crafted packets
- CVSS
- 7.5
- Published
- 2025-11-18
Fixed in7.4.9,7.6.4NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗ - HIGHCVE-2024-50565
CVE-2024-50565
A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0.0 through 7.0.14, 6.4.0 through 6.4.15 and 6.2.0 through 6.2.16, Fortinet FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.9, 7.0.0 through 7.0.15 and 2.0.0 through 2.0.14, Fortinet FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.14 and 6.2.0 through 6.2.13, Fortinet FortiAnalyzer version 7.4.0 through 7.4.2, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.14 and 6.2.0 through 6.2.13, Fortinet FortiVoice version 7.0.0 through 7.0.2, 6.4.0 through 6.4.8 and 6.0.0 through 6.0.12 and Fortinet FortiWeb version 7.4.0 through 7.4.2, 7.2.0 through 7.2.10, 7.0.0 through 7.0.10 allows an unauthenticated attacker in a man-in-the-middle position to impersonate the management device (FortiCloud server or/and in certain conditions, FortiManager), via intercepting the FGFM authentication request between the management device and the managed device
- CVSS
- 7.5
- Published
- 2025-04-08
Fixed in7.0.16,7.2.9,7.4.5NVD ↗fortiguard.fortinet.com ↗ - HIGHCVE-2024-23662
CVE-2024-23662
An exposure of sensitive information to an unauthorized actor in Fortinet FortiOS at least version at least 7.4.0 through 7.4.1 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.15 and 6.4.0 through 6.4.15 allows attacker to information disclosure via HTTP requests.
- CVSS
- 7.5
- Published
- 2024-04-09
Fixed in7.2.6,7.4.2NVD ↗fortiguard.com ↗ - HIGHCVE-2022-39948
CVE-2022-39948
An improper certificate validation vulnerability [CWE-295] in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.7, 6.4 all versions, 6.2 all versions, 6.0 all versions and FortiProxy 7.0.0 through 7.0.6, 2.0 all versions, 1.2 all versions may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the FortiOS/FortiProxy device and remote servers hosting threat feeds (when the latter are configured as Fabric connectors in FortiOS/FortiProxy)
- CVSS
- 7.4
- Published
- 2023-02-16
Fixed in7.0.8,7.2.4NVD ↗fortiguard.com ↗ - HIGHCVE-2023-45584
CVE-2023-45584
A double free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.4.0 through 7.4.1, FortiProxy 7.2.0 through 7.2.7, FortiProxy 7.0.0 through 7.0.13 allows a privileged attacker to execute code or commands via crafted HTTP or HTTPs requests.
- CVSS
- 7.2
- Published
- 2025-08-12
Fixed in7.0.13,7.2.6NVD ↗fortiguard.fortinet.com ↗ - HIGHCVE-2025-22254
CVE-2025-22254
An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2.0 through 7.2.10, FortiOS 7.0.0 through 7.0.16, FortiOS 6.4.0 through 6.4.15, FortiProxy 7.6.0 through 7.6.1, FortiProxy 7.4.0 through 7.4.7, FortiWeb 7.6.0 through 7.6.1, FortiWeb 7.4.0 through 7.4.6 allows an authenticated attacker with at least read-only admin permissions to gain super-admin privileges via crafted requests to Node.js websocket module.
- CVSS
- 7.2
- Published
- 2025-06-10
Fixed in6.4.16,7.0.17,7.2.11,7.4.7,7.6.2NVD ↗fortiguard.fortinet.com ↗ - HIGHCVE-2025-53744
CVE-2025-53744
An incorrect privilege assignment vulnerability [CWE-266] in FortiOS Security Fabric version 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, 7.2 all versions, 7.0 all versions, 6.4 all versions, may allow a remote authenticated attacker with high privileges to escalate their privileges to super-admin via registering the device to a malicious FortiManager.
- CVSS
- 7.2
- Published
- 2025-08-12
Fixed in7.4.8,7.6.3NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗ - HIGHCVE-2024-50571
CVE-2024-50571
A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.0 through 7.4.5, FortiAnalyzer 7.2.0 through 7.2.9, FortiAnalyzer 7.0.0 through 7.0.13, FortiAnalyzer 6.4 all versions, FortiAnalyzer 6.2 all versions, FortiAnalyzer 6.0 all versions, FortiAnalyzer Cloud 7.4.1 through 7.4.5, FortiAnalyzer Cloud 7.2.1 through 7.2.9, FortiAnalyzer Cloud 7.0.1 through 7.0.13, FortiAnalyzer Cloud 6.4 all versions, FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.0 through 7.4.5, FortiManager 7.2.0 through 7.2.9, FortiManager 7.0.0 through 7.0.13, FortiManager 6.4 all versions, FortiManager 6.2 all versions, FortiManager 6.0 all versions, FortiManager Cloud 7.6.2, FortiManager Cloud 7.4.1 through 7.4.5, FortiManager Cloud 7.2.1 through 7.2.9, FortiManager Cloud 7.0.1 through 7.0.13, FortiManager Cloud 6.4 all versions, FortiOS 7.6.0 through 7.6.2, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2.0 through 7.2.10, FortiOS 7.0.0 through 7.0.16, FortiOS 6.4.0 through 6.4.15, FortiOS 6.2 all versions, FortiProxy 7.6.0 through 7.6.1, FortiProxy 7.4.0 through 7.4.7, FortiProxy 7.2.0 through 7.2.12, FortiProxy 7.0.0 through 7.0.19, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1 all versions, FortiProxy 1.0 all versions allows attacker to execute unauthorized code or commands via specifically crafted requests.
- CVSS
- 7.2
- Published
- 2025-10-14
Fixed in6.4.16,7.0.17,7.2.11,7.4.7,7.6.3NVD ↗fortiguard.fortinet.com ↗ - HIGHCVE-2023-45583
CVE-2023-45583
A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0.0 through 6.0.16, FortiPAM 1.1.0, FortiPAM 1.0 all versions, FortiProxy 7.2.0 through 7.2.5, FortiProxy 7.0.0 through 7.0.11, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1 all versions, FortiProxy 1.0 all versions, FortiSwitchManager 7.2.0 through 7.2.2, FortiSwitchManager 7.0.0 through 7.0.2 allows attacker to execute unauthorized code or commands via specially crafted cli commands and http requests.
- CVSS
- 7.2
- Published
- 2024-05-14
Fixed in7.2.6NVD ↗fortiguard.com ↗ - HIGHCVE-2024-40591
CVE-2024-40591
An incorrect privilege assignment vulnerability [CWE-266] in Fortinet FortiOS version 7.6.0, 7.4.0 through 7.4.4, 7.2.0 through 7.2.9 and before 7.0.15 allows an authenticated admin whose access profile has the Security Fabric permission to escalate their privileges to super-admin by connecting the targetted FortiGate to a malicious upstream FortiGate they control.
- CVSS
- 7.2
- Published
- 2025-02-11
Fixed in6.4.16,7.0.16,7.2.10,7.4.5NVD ↗fortiguard.fortinet.com ↗ - HIGHCVE-2024-45324
CVE-2024-45324
A use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.0 through 7.4.4, version 7.2.0 through 7.2.9, version 7.0.0 through 7.0.15 and before 6.4.15, FortiProxy version 7.4.0 through 7.4.6, version 7.2.0 through 7.2.12 and before 7.0.19, FortiPAM version 1.4.0 through 1.4.2 and before 1.3.1, FortiSRA version 1.4.0 through 1.4.2 and before 1.3.1 and FortiWeb version 7.4.0 through 7.4.5, version 7.2.0 through 7.2.10 and before 7.0.10 allows a privileged attacker to execute unauthorized code or commands via specially crafted HTTP or HTTPS commands.
- CVSS
- 7.2
- Published
- 2025-03-11
Fixed in6.2.17,6.4.16,7.0.16,7.2.10,7.4.5NVD ↗fortiguard.fortinet.com ↗ - HIGHCVE-2023-44247
CVE-2023-44247
A double free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 6.4 all versions may allow a privileged attacker to execute code or commands via crafted HTTP or HTTPs requests.
- CVSS
- 7.2
- Published
- 2024-05-14
- MEDIUMCVE-2025-58325
CVE-2025-58325
An Incorrect Provision of Specified Functionality vulnerability [CWE-684] in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2.5 through 7.2.10, 7.0.0 through 7.0.15, 6.4 all versions may allow a local authenticated attacker to execute system commands via crafted CLI commands.
- CVSS
- 6.7
- Published
- 2025-10-14
Fixed in7.0.16,7.2.11,7.4.6NVD ↗fortiguard.fortinet.com ↗ - MEDIUMCVE-2023-29182
CVE-2023-29182
A stack-based buffer overflow vulnerability [CWE-121] in Fortinet FortiOS before 7.0.3 allows a privileged attacker to execute arbitrary code via specially crafted CLI commands, provided the attacker were able to evade FortiOS stack protections.
- CVSS
- 6.7
- Published
- 2023-08-17
Fixed in7.0.4NVD ↗fortiguard.com ↗ - MEDIUMCVE-2023-28002
CVE-2023-28002
An improper validation of integrity check value vulnerability [CWE-354] in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.12, 6.4 all versions, 6.2 all versions, 6.0 all versions and VMs may allow a local attacker with admin privileges to boot a malicious image on the device and bypass the filesystem integrity check in place.
- CVSS
- 6.7
- Published
- 2023-11-14
- MEDIUMCVE-2023-36640
CVE-2023-36640
A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0.0 through 6.0.16, FortiPAM 1.1.0, FortiPAM 1.0 all versions, FortiProxy 7.2.0 through 7.2.5, FortiProxy 7.0.0 through 7.0.11, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1 all versions, FortiProxy 1.0 all versions allows attacker to execute unauthorized code or commands via specially crafted commands
- CVSS
- 6.7
- Published
- 2024-05-14
- MEDIUMCVE-2023-40721
CVE-2023-40721
A use of externally-controlled format string vulnerability [CWE-134] vulnerability in Fortinet allows a privileged attacker to execute arbitrary code or commands via specially crafted requests.
- CVSS
- 6.7
- Published
- 2025-02-11
Fixed in7.0.14,7.2.7NVD ↗fortiguard.com ↗ - MEDIUMCVE-2023-48784
CVE-2023-48784
A use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.1 and below, version 7.2.7 and below, 7.0 all versions, 6.4 all versions command line interface may allow a local privileged attacker with super-admin profile and CLI access to execute arbitrary code or commands via specially crafted requests.
- CVSS
- 6.7
- Published
- 2024-04-09
Fixed in7.0.16,7.2.8,7.4.2NVD ↗fortiguard.com ↗ - MEDIUMCVE-2023-29179
CVE-2023-29179
A null pointer dereference in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, Fortiproxy version 7.2.0 through 7.2.4, 7.0.0 through 7.0.10 allows attacker to denial of service via specially crafted HTTP requests.
- CVSS
- 6.5
- Published
- 2024-02-22
Fixed in6.4.13,7.0.12,7.2.5NVD ↗fortiguard.com ↗ - MEDIUMCVE-2023-33305
CVE-2023-33305
A loop with unreachable exit condition ('infinite loop') in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS version 7.0.0 through 7.0.10, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiProxy version 7.2.0 through 7.2.3, FortiProxy version 7.0.0 through 7.0.9, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1 all versions, FortiProxy 1.0 all versions, FortiWeb version 7.2.0 through 7.2.1, FortiWeb version 7.0.0 through 7.0.6, FortiWeb 6.4 all versions, FortiWeb 6.3 all versions allows attacker to perform a denial of service via specially crafted HTTP requests.
- CVSS
- 6.5
- Published
- 2023-06-13
- MEDIUMCVE-2025-25248
CVE-2025-25248
An Integer Overflow or Wraparound vulnerability [CWE-190] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, 7.2 all versions, 6.4 all versions, FortiProxy version 7.6.2 and below, version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 2.0 all versions and FortiPAM version 1.5.0, version 1.4.2 and below, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions SSL-VPN RDP and VNC bookmarks may allow an authenticated user to affect the device SSL-VPN availability via crafted requests.
- CVSS
- 6.5
- Published
- 2025-08-12
Fixed in7.2.11,7.4.8,7.6.3NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗ - MEDIUMCVE-2023-42786
CVE-2023-42786
A null pointer dereference in FortiOS versions 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0 all versions, 6.4 all versions , 6.2 all versions and 6.0 all versions allows attacker to trigger a denial of service via a crafted http request.
- CVSS
- 6.5
- Published
- 2025-01-14
Fixed in7.2.6,7.4.2NVD ↗fortiguard.fortinet.com ↗ - MEDIUMCVE-2022-45861
CVE-2022-45861
An access of uninitialized pointer vulnerability [CWE-824] in the SSL VPN portal of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9 and before 6.4.11 and FortiProxy version 7.2.0 through 7.2.1, version 7.0.0 through 7.0.7 and before 2.0.11 allows a remote authenticated attacker to crash the sslvpn daemon via an HTTP GET request.
- CVSS
- 6.5
- Published
- 2023-03-07
- MEDIUMCVE-2023-33306
CVE-2023-33306
A null pointer dereference in Fortinet FortiOS before 7.2.5, before 7.0.11 and before 6.4.13, FortiProxy before 7.2.4 and before 7.0.10 allows attacker to denial of sslvpn service via specifically crafted request in bookmark parameter.
- CVSS
- 6.5
- Published
- 2023-06-16
Fixed in6.4.13,7.0.11,7.2.5NVD ↗fortiguard.com ↗ - MEDIUMCVE-2025-61624
CVE-2025-61624
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.
- CVSS
- 6.5
- Published
- 2026-04-14
Fixed in7.4.10,7.6.5NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗ - MEDIUMCVE-2025-25252
CVE-2025-25252
An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4 all versions may allow a remote attacker (e.g. a former admin whose account was removed and whose session was terminated) in possession of the SAML record of a user session to access or re-open that session via re-use of SAML record.
- CVSS
- 6.5
- Published
- 2025-10-14
Fixed in7.0.17,7.2.11,7.4.7,7.6.3NVD ↗fortiguard.fortinet.com ↗ - MEDIUMCVE-2023-36641
CVE-2023-36641
A numeric truncation error in Fortinet FortiProxy version 7.2.0 through 7.2.4, FortiProxy version 7.0.0 through 7.0.10, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1, all versions, FortiProxy 1.0 all versions, FortiOS version 7.4.0, FortiOS version 7.2.0 through 7.2.5, FortiOS version 7.0.0 through 7.0.12, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions allows attacker to denial of service via specifically crafted HTTP requests.
- CVSS
- 6.5
- Published
- 2023-11-14
- MEDIUMCVE-2024-36504
CVE-2024-36504
An out-of-bounds read vulnerability [CWE-125] in FortiOS SSLVPN web portal versions 7.4.0 through 7.4.4, versions 7.2.0 through 7.2.8, 7.0 all verisons, and 6.4 all versions may allow an authenticated attacker to perform a denial of service on the SSLVPN web portal via a specially crafted URL.
- CVSS
- 6.5
- Published
- 2025-01-14
Fixed in7.2.9,7.4.5NVD ↗fortiguard.fortinet.com ↗ - MEDIUMCVE-2023-42785
CVE-2023-42785
A null pointer dereference in FortiOS versions 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0 all versions, 6.4 all versions , 6.2 all versions and 6.0 all versions allows attacker to trigger a denial of service via a crafted http request.
- CVSS
- 6.5
- Published
- 2025-01-14
Fixed in7.2.6,7.4.2NVD ↗fortiguard.fortinet.com ↗ - MEDIUMCVE-2024-26006
CVE-2024-26006
An improper neutralization of input during web page Generation vulnerability [CWE-79] in FortiOS version 7.4.3 and below, version 7.2.7 and below, version 7.0.13 and below and FortiProxy version 7.4.3 and below, version 7.2.9 and below, version 7.0.16 and below web SSL VPN UI may allow a remote unauthenticated attacker to perform a Cross-Site Scripting attack via a malicious samba server.
- CVSS
- 6.1
- Published
- 2025-03-14
Fixed in7.0.14,7.2.8,7.4.4NVD ↗fortiguard.fortinet.com ↗ - MEDIUMCVE-2025-47890
CVE-2025-47890
An URL Redirection to Untrusted Site vulnerabilities [CWE-601] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSASE 25.2.a may allow an unauthenticated attacker to perform an open redirect attack via crafted HTTP requests.
- CVSS
- 6.1
- Published
- 2025-10-14
Fixed in7.4.9,7.6.4NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗ - MEDIUMCVE-2022-41330
CVE-2022-41330
An improper neutralization of input during web page generation vulnerability ('Cross-site Scripting') [CWE-79] in Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9, version 6.4.0 through 6.4.11 and before 6.2.12 and FortiProxy version 7.2.0 through 7.2.1 and before 7.0.7 allows an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests.
- CVSS
- 6.1
- Published
- 2023-04-11
Fixed in6.2.13,6.4.12,7.0.10,7.2.4NVD ↗fortiguard.com ↗ - MEDIUMCVE-2025-31366
CVE-2025-31366
An Improper Neutralization of Input During Web Page Generation vulnerability [CWE-79] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSASE 25.2.a may allow an unauthenticated attacker to perform a reflected cross site scripting (XSS) via crafted HTTP requests.
- CVSS
- 6.1
- Published
- 2025-10-14
Fixed in7.4.9,7.6.4NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗ - MEDIUMCVE-2022-38378
CVE-2022-38378
An improper privilege management vulnerability [CWE-269] in Fortinet FortiOS version 7.2.0 and before 7.0.7 and FortiProxy version 7.2.0 through 7.2.1 and before 7.0.7 allows an attacker that has access to the admin profile section (System subsection Administrator Users) to modify their own profile and upgrade their privileges to Read Write via CLI or GUI commands.
- CVSS
- 6
- Published
- 2023-02-16
Fixed in7.0.8,7.2.1NVD ↗fortiguard.com ↗ - MEDIUMCVE-2024-52963
CVE-2024-52963
A out-of-bounds write in Fortinet FortiOS versions 7.6.0, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4.0 through 6.4.15 allows attacker to trigger a denial of service via specially crafted packets.
- CVSS
- 5.9
- Published
- 2025-01-14
Fixed in7.2.11,7.4.8NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗ - MEDIUMCVE-2024-50568
CVE-2024-50568
A channel accessible by non-endpoint vulnerability [CWE-300] in Fortinet FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7 and before 7.0.14 & FortiProxy version 7.4.0 through 7.4.3, 7.2.0 through 7.2.9 and before 7.0.16 allows an unauthenticated attacker with the knowledge of device specific data to spoof the identity of a downstream device of the security fabric via crafted TCP requests.
- CVSS
- 5.9
- Published
- 2025-06-10
Fixed in7.2.9,7.4.4NVD ↗fortiguard.fortinet.com ↗ - MEDIUMCVE-2025-68686
CVE-2025-68686
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.
- CVSS
- 5.9
- Published
- 2026-02-10
Fixed in7.4.7,7.6.2NVD ↗fortiguard.fortinet.com ↗ - MEDIUMCVE-2025-55018
CVE-2025-55018
An inconsistent interpretation of http requests ('http request smuggling') vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4.3 through 6.4.16 may allow an unauthenticated attacker to smuggle an unlogged http request through the firewall policies via a specially crafted header
- CVSS
- 5.8
- Published
- 2026-02-10
Fixed in7.4.10NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗ - MEDIUMCVE-2025-62631
CVE-2025-62631
An insufficient session expiration vulnerability [CWE-613] vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to maintain access to network resources via an active SSLVPN session not terminated after a user's password change under particular conditions outside of the attacker's control
- CVSS
- 5.6
- Published
- 2025-12-09
Fixed in7.4.1NVD ↗fortiguard.fortinet.com ↗ - MEDIUMCVE-2022-42472
CVE-2022-42472
A improper neutralization of crlf sequences in http headers ('http response splitting') in Fortinet FortiOS versions 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.11, 6.2.0 through 6.2.12, 6.0.0 through 6.0.16, FortiProxy 7.2.0 through 7.2.1, 7.0.0 through 7.0.7, 2.0.0 through 2.0.10, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6 may allow an authenticated and remote attacker to perform an HTTP request splitting attack which gives attackers control of the remaining headers and body of the response.
- CVSS
- 5.4
- Published
- 2023-02-16
- MEDIUMCVE-2023-22641
CVE-2023-22641
A url redirection to untrusted site ('open redirect') in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.9, FortiOS versions 6.4.0 through 6.4.12, FortiOS all versions 6.2, FortiOS all versions 6.0, FortiProxy version 7.2.0 through 7.2.2, FortiProxy version 7.0.0 through 7.0.8, FortiProxy all versions 2.0, FortiProxy all versions 1.2, FortiProxy all versions 1.1, FortiProxy all versions 1.0 allows an authenticated attacker to execute unauthorized code or commands via specially crafted requests.
- CVSS
- 5.4
- Published
- 2023-04-11
Fixed in6.4.13,7.0.11,7.2.4NVD ↗fortiguard.com ↗ - MEDIUMCVE-2023-29183
CVE-2023-29183
An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiProxy 7.2.0 through 7.2.4, 7.0.0 through 7.0.10 and FortiOS 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.14 GUI may allow an authenticated attacker to trigger malicious JavaScript code execution via crafted guest management setting.
- CVSS
- 5.4
- Published
- 2023-09-13
Fixed in6.2.15,6.4.13,7.0.12,7.2.5NVD ↗fortiguard.com ↗ - MEDIUMCVE-2025-47294
CVE-2025-47294
A integer overflow or wraparound in Fortinet FortiOS versions 7.2.0 through 7.2.7, versions 7.0.0 through 7.0.14 may allow a remote unauthenticated attacker to crash the csfd daemon via a specially crafted request.
- CVSS
- 5.3
- Published
- 2025-05-28
Fixed in7.0.15,7.2.8NVD ↗fortiguard.fortinet.com ↗ - MEDIUMCVE-2023-47536
CVE-2023-47536
An improper access control vulnerability [CWE-284] in FortiOS version 7.2.0, version 7.0.13 and below, version 6.4.14 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below may allow a remote unauthenticated attacker to bypass the firewall deny geolocalisation policy via timing the bypass with a GeoIP database update.
- CVSS
- 5.3
- Published
- 2023-12-13
- MEDIUMCVE-2024-26008
CVE-2024-26008
An improper check or handling of exceptional conditions vulnerability [CWE-703] in FortiOS version 7.4.0 through 7.4.3 and before 7.2.7, FortiProxy version 7.4.0 through 7.4.3 and before 7.2.9, FortiPAM before 1.2.0 and FortiSwitchManager version 7.2.0 through 7.2.3 and version 7.0.0 through 7.0.3 fgfm daemon may allow an unauthenticated attacker to repeatedly reset the fgfm connection via crafted SSL encrypted TCP requests.
- CVSS
- 5.3
- Published
- 2025-10-14
Fixed in7.2.8,7.4.4NVD ↗fortiguard.fortinet.com ↗ - MEDIUMCVE-2024-46666
CVE-2024-46666
An allocation of resources without limits or throttling [CWE-770] vulnerability in FortiOS versions 7.6.0, versions 7.4.4 through 7.4.0, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow a remote unauthenticated attacker to prevent access to the GUI via specially crafted requests directed at specific endpoints.
- CVSS
- 5.3
- Published
- 2025-01-14
Fixed in7.2.9,7.4.5NVD ↗fortiguard.fortinet.com ↗ - MEDIUMCVE-2024-55599
CVE-2024-55599
An Improperly Implemented Security Check for Standard vulnerability [CWE-358] in FortiOS version 7.6.0, version 7.4.7 and below, 7.0 all versions, 6.4 all versions and FortiProxy version 7.6.1 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions may allow a remote unauthenticated user to bypass the DNS filter via Apple devices.
- CVSS
- 5.3
- Published
- 2025-07-08
Fixed in7.2.11,7.4.8NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗ - MEDIUMCVE-2025-22251
CVE-2025-22251
An improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow an unauthenticated attacker to inject unauthorized sessions via crafted FGSP session synchronization packets.
- CVSS
- 5.3
- Published
- 2025-06-10
Fixed in7.4.6NVD ↗fortiguard.fortinet.com ↗ - MEDIUMCVE-2022-41329
CVE-2022-41329
An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in Fortinet FortiProxy version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.7, FortiOS version 7.2.0 through 7.2.3 and 7.0.0 through 7.0.9 allows an unauthenticated attackers to obtain sensitive logging informations on the device via crafted HTTP GET requests.
- CVSS
- 5.3
- Published
- 2023-03-07
- MEDIUMCVE-2023-45586
CVE-2023-45586
An insufficient verification of data authenticity vulnerability [CWE-345] in Fortinet FortiOS SSL-VPN tunnel mode version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.7 and before 7.0.12 & FortiProxy SSL-VPN tunnel mode version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.7 and before 7.0.13 allows an authenticated VPN user to send (but not receive) packets spoofing the IP of another user via crafted network packets.
- CVSS
- 5
- Published
- 2024-05-14
Fixed in7.0.13,7.2.8NVD ↗fortiguard.com ↗ - MEDIUMCVE-2025-58903
CVE-2025-58903
An Unchecked Return Value vulnerability [CWE-252] in Fortinet FortiOS version 7.6.0 through 7.6.3 and before 7.4.8 API allows an authenticated user to cause a Null Pointer Dereference, crashing the http daemon via a specialy crafted request.
- CVSS
- 4.9
- Published
- 2025-10-14
Fixed in7.4.9,7.6.4NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗ - MEDIUMCVE-2024-50562
CVE-2024-50562
An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions may allow an attacker in possession of a cookie used to log in the SSL-VPN portal to log in again, although the session has expired or was logged out.
- CVSS
- 4.8
- Published
- 2025-06-10
Fixed in7.2.11,7.4.8NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗ - MEDIUMCVE-2023-29175
CVE-2023-29175
An improper certificate validation vulnerability [CWE-295] in FortiOS 6.2 all versions, 6.4 all versions, 7.0.0 through 7.0.10, 7.2.0 and FortiProxy 1.2 all versions, 2.0 all versions, 7.0.0 through 7.0.9, 7.2.0 through 7.2.3 may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the vulnerable device and the remote FortiGuard's map server.
- CVSS
- 4.8
- Published
- 2023-06-13
Fixed in7.0.11NVD ↗fortiguard.com ↗ - MEDIUMCVE-2023-47537
CVE-2023-47537
An improper certificate validation vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.15, FortiOS 6.4 all versions allows a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the FortiLink communication channel between the FortiOS device and FortiSwitch.
- CVSS
- 4.8
- Published
- 2024-02-15
Fixed in7.0.14NVD ↗fortiguard.com ↗ - MEDIUMCVE-2024-21754
CVE-2024-21754
A use of password hash with insufficient computational effort vulnerability [CWE-916] affecting FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 6.4 all versions and FortiProxy version 7.4.2 and below, 7.2 all versions, 7.0 all versions, 2.0 all versions may allow a privileged attacker with super-admin profile and CLI access to decrypting the backup file.
- CVSS
- 4.4
- Published
- 2024-06-11
Fixed in7.2.9,7.4.4NVD ↗fortiguard.fortinet.com ↗ - MEDIUMCVE-2024-32122
CVE-2024-32122
A storing passwords in a recoverable format in Fortinet FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to information disclosure via modification of LDAP server IP to point to a malicious server.
- CVSS
- 4.4
- Published
- 2025-04-08
- MEDIUMCVE-2023-46715
CVE-2023-46715
An origin validation error [CWE-346] vulnerability in Fortinet FortiOS IPSec VPN version 7.4.0 through 7.4.1 and version 7.2.6 and below allows an authenticated IPSec VPN user with dynamic IP addressing to send (but not receive) packets spoofing the IP of another user via crafted network packets.
- CVSS
- 4.3
- Published
- 2025-01-14
Fixed in7.4.2NVD ↗fortiguard.com ↗ - MEDIUMCVE-2023-29178
CVE-2023-29178
A access of uninitialized pointer vulnerability [CWE-824] in Fortinet FortiProxy version 7.2.0 through 7.2.3 and before 7.0.9 and FortiOS version 7.2.0 through 7.2.4 and before 7.0.11 allows an authenticated attacker to repetitively crash the httpsd process via crafted HTTP or HTTPS requests.
- CVSS
- 4.3
- Published
- 2023-06-13
- MEDIUMCVE-2025-31514
CVE-2025-31514
A insertion of sensitive information into log file vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.13, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions may allow attacker to information disclosure via <insert attack vector here>
- CVSS
- 4.3
- Published
- 2025-10-14
Fixed in7.6.4NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗ - MEDIUMCVE-2024-23112
CVE-2024-23112
An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiOS version 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.1 through 7.0.13, 6.4.7 through 6.4.14, and FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14 SSL-VPN may allow an authenticated attacker to gain access to another user's bookmark via URL manipulation.
- CVSS
- 4.3
- Published
- 2024-03-12
- MEDIUMCVE-2024-47569
CVE-2024-47569
A insertion of sensitive information into sent data vulnerability in Fortinet FortiMail 7.4.0 through 7.4.2, FortiMail 7.2.0 through 7.2.6, FortiMail 7.0 all versions, FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.1 through 7.4.3, FortiManager Cloud 7.4.1 through 7.4.3, FortiNDR 7.6.0 through 7.6.1, FortiNDR 7.4.0 through 7.4.8, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions, FortiNDR 7.0 all versions, FortiNDR 1.5 all versions, FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.4, FortiOS 7.2.0 through 7.2.8, FortiOS 7.0.0 through 7.0.15, FortiOS 6.4.0 through 6.4.15, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.4.0 through 7.4.4, FortiProxy 7.2.0 through 7.2.10, FortiProxy 7.0 all versions, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1 all versions, FortiProxy 1.0 all versions, FortiRecorder 7.2.0 through 7.2.1, FortiRecorder 7.0.0 through 7.0.4, FortiTester 7.4.0 through 7.4.2, FortiTester 7.3 all versions, FortiTester 7.2 all versions, FortiTester 7.1 all versions, FortiTester 7.0 all versions, FortiTester 4.2 all versions, FortiVoice 7.0.0 through 7.0.4, FortiVoice 6.4.0 through 6.4.9, FortiVoice 6.0.7 through 6.0.12, FortiWeb 7.6.0, FortiWeb 7.4.0 through 7.4.4, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions, FortiWeb 6.4 all versions allows attacker to disclose sensitive information via specially crafted packets.
- CVSS
- 4.3
- Published
- 2025-10-14
Fixed in6.4.16,7.0.16,7.2.9,7.4.5NVD ↗fortiguard.fortinet.com ↗ - LOWCVE-2025-47295
CVE-2025-47295
A buffer over-read in Fortinet FortiOS versions 7.4.0 through 7.4.3, versions 7.2.0 through 7.2.7, and versions 7.0.0 through 7.0.14 may allow a remote unauthenticated attacker to crash the FGFM daemon via a specially crafted request, under rare conditions that are outside of the attacker's control.
- CVSS
- 3.7
- Published
- 2025-05-28
Fixed in7.0.15,7.2.8,7.4.4NVD ↗fortiguard.fortinet.com ↗ - LOWCVE-2022-29054
CVE-2022-29054
A missing cryptographic steps vulnerability [CWE-325] in the functions that encrypt the DHCP and DNS keys in Fortinet FortiOS version 7.2.0, 7.0.0 through 7.0.5, 6.4.0 through 6.4.9, 6.2.x and 6.0.x may allow an attacker in possession of the encrypted key to decipher it.
- CVSS
- 3.3
- Published
- 2023-02-16
Fixed in7.0.8NVD ↗fortiguard.com ↗ - LOWCVE-2022-42474
CVE-2022-42474
A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9 and before 6.4.12, FortiProxy version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.7, FortiSwitchManager version 7.2.0 through 7.2.1 and before 7.0.1 allows an privileged attacker to delete arbitrary directories from the filesystem through crafted HTTP requests.
- CVSS
- 2.7
- Published
- 2023-06-13
- LOWCVE-2023-29184
CVE-2023-29184
An incomplete cleanup vulnerability [CWE-459] in FortiOS 7.2 all versions and before & FortiProxy version 7.2.0 through 7.2.2 and before 7.0.8 allows a VDOM privileged attacker to add SSH key files on the system silently via crafted CLI requests.
- CVSS
- 2.3
- Published
- 2025-06-10
Stop checking versions by hand
Is your whole fleet exposed, not just this FortiGate?
VulnMonitor reconciles every advisory against your real inventory and ranks what matters by actual exploitation (CISA KEV, EPSS), not raw CVSS. New CVE hits your gear, it is on your queue with the fix attached.
Free to start · no credit card
Other FortiGate versions
- 7.2.0 132 CVEs · 7 KEV
- 7.0.3 130 CVEs · 10 KEV
- 7.0.2 130 CVEs · 10 KEV
- 7.0.1 129 CVEs · 10 KEV
- 7.2.2 128 CVEs · 7 KEV
- 7.2.1 128 CVEs · 7 KEV
- 7.0.5 128 CVEs · 9 KEV
- 7.0.4 128 CVEs · 9 KEV
- 7.0.0 126 CVEs · 10 KEV
- 7.0.10 111 CVEs · 7 KEV
- 6.4.8 104 CVEs · 4 KEV
- 6.4.6 102 CVEs · 4 KEV
- 6.4.1 101 CVEs · 4 KEV
- 6.4.0 101 CVEs · 4 KEV