Vulnerabilità per vendor · aggiornato a ogni pubblicazione
Vulnerabilità Fortinet: CVE sfruttate e nostre analisi
Fortinet ha 32 vulnerabilità nel catalogo CISA Known Exploited Vulnerabilities, 12 delle quali aggiunte negli ultimi 12 mesi e 14 note per l'uso in campagne ransomware. Qui sotto: le 6 analisi pubblicate da Zero Hunt Research sui prodotti Fortinet, poi le voci del catalogo dalla più recente, con la scadenza federale.
Catalogo CISA versione 2026.10.21, pubblicato il 2026-10-21 14:04 UTC.
32
CVE in CISA KEV
12
Aggiunte negli ultimi 12 mesi
14
Uso noto nel ransomware
6
Analisi Zero Hunt
Prodotti con più voci nel KEV: FortiOS (9) · Multiple Products (7) · FortiOS and FortiProxy (4) · FortiClient EMS (3) · FortiWeb (3) · FortiSandbox (2)
Le nostre analisi delle vulnerabilità Fortinet
2026-10-19
Impianto FortiGate PEERSTITCH: CVE-2025-61624 e una breccia telecom di 25 mesiUn impianto FortiGate solo-in-memoria, PEERSTITCH, è rimasto 25 mesi in una telecom. CVE-2025-61624 è in KEV, scade oggi — e la patch da sola non basta.
2026-10-02
FortiMail CVE-2026-104286: scrittura file non autenticata, sfruttata come zero-dayFortiMail CVE-2026-104286: scrittura file non autenticata (path traversal), CVSS 9.8, sfruttata in rete per installare una backdoor. Patch e hunting.
2026-07-18
FortiSandbox CVE-2026-25089: RCE non autenticato nella sandbox che giudica il malwareDue RCE non autenticate (CVE-2026-25089, CVE-2026-39808, CVSS 9.8) consegnano agli attaccanti FortiSandbox — l'appliance che emette i verdetti sul malware per tutto il fabric. In CISA KEV, sfruttate attivamente.
2026-06-20
FortiBleed: 74.000 firewall Fortinet esposti e nessuna patch da applicareFortiBleed ha esposto credenziali VPN valide di ~74.000 firewall Fortinet in 194 Paesi. Nessun CVE da correggere: l'attaccante entra come admin legittimo e lo scanner non vede nulla.
2026-06-17
FortiSandbox CVE-2026-39808: l'appliance di sicurezza che nessuno controllaDue falle FortiSandbox (CVE-2026-39808, CVE-2026-39813) corrette ad aprile sono ora sfruttate in the wild. Perché le appliance di sicurezza agentless sono un punto cieco — e come vederne la compromissione.
2026-05-31
FortiClient EMS CVE-2026-35616: quando la patch del tuo vendor è il malwareL'infostealer EKZ è arrivato sugli endpoint gestiti camuffato da aggiornamento Fortinet — spinto attraverso l'API di FortiClient EMS dopo un bypass non autenticato. Due mesi tra il bollettino e la campagna attiva, e Fortinet non ha ancora pubblicato IOC.
Tutte le 32 voci KEV
| Aggiunta | CVE | Prodotto e vulnerabilità | Scadenza federale | Segnalazioni | Nostra analisi |
|---|---|---|---|---|---|
| 2026-10-16 | CVE-2025-61624 | Multiple Products FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary… | 2026-10-19 | Triage forense | Leggi → |
| 2026-10-01 | CVE-2026-104286 | FortiMail Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via… | 2026-10-04 | Triage forense | Leggi → |
| 2026-09-09 | CVE-2025-25249 | Multiple Products Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets. | 2026-09-12 | Triage forense | — |
| 2026-07-27 | CVE-2025-68686 | FortiOS Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency m… | 2026-08-10 | — | |
| 2026-07-16 | CVE-2026-39808 | FortiSandbox Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests. | 2026-07-19 | Triage forense | Leggi → |
| 2026-07-16 | CVE-2026-25089 | FortiSandbox Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP req… | 2026-07-19 | Triage forense | Leggi → |
| 2026-04-13 | CVE-2026-21643 | FortiClient EMS Fortinet FortiClient EMS contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests. | 2026-04-16 | — | |
| 2026-04-06 | CVE-2026-35616 | FortiClient EMS Fortinet FortiClient EMS contains an improper access control vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests. | 2026-04-09 | Leggi → | |
| 2026-01-27 | CVE-2026-24858 | Multiple Products Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authentication bypass using an alternate path or channel that could allow an attacker with a FortiCloud account and a registered device to log i… | 2026-01-30 | — | |
| 2025-12-16 | CVE-2025-59718 | Multiple Products Fortinet FortiOS, FortiSwitchMaster, FortiProxy, and FortiWeb contain an improper verification of cryptographic signature vulnerability that may allow an unauthenticated attacker to bypass the FortiCloud SSO login aut… | 2025-12-23 | — | |
| 2025-11-18 | CVE-2025-58034 | FortiWeb Fortinet FortiWeb contains an OS command Injection vulnerability that may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands. | 2025-11-25 | — | |
| 2025-11-14 | CVE-2025-64446 | FortiWeb Fortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests. | 2025-11-21 | — | |
| 2025-07-18 | CVE-2025-25257 | FortiWeb Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests. | 2025-08-08 | — | |
| 2025-06-25 | CVE-2019-6693 | FortiOS Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key. | 2025-07-16 | Ransomware | — |
| 2025-05-14 | CVE-2025-32756 | Multiple Products Fortinet FortiFone, FortiVoice, FortiNDR and FortiMail contain a stack-based overflow vulnerability that may allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted HTTP requests. | 2025-06-04 | — | |
| 2025-03-18 | CVE-2025-24472 | FortiOS and FortiProxy Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests. | 2025-04-08 | Ransomware | — |
| 2025-01-14 | CVE-2024-55591 | FortiOS and FortiProxy Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that may allow an unauthenticated, remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module. | 2025-01-21 | Ransomware | — |
| 2024-10-23 | CVE-2024-47575 | FortiManager Fortinet FortiManager contains a missing authentication vulnerability in the fgfmd daemon that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests. | 2024-11-13 | — | |
| 2024-10-09 | CVE-2024-23113 | Multiple Products Fortinet FortiOS, FortiPAM, FortiProxy, and FortiWeb contain a format string vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests. | 2024-10-30 | — | |
| 2024-03-25 | CVE-2023-48788 | FortiClient EMS Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an unauthenticated attacker to execute commands as SYSTEM via specifically crafted requests. | 2024-04-15 | Ransomware | — |
| 2024-02-09 | CVE-2024-21762 | FortiOS Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remote unauthenticated attacker to execute code or commands via specially crafted HTTP requests. | 2024-02-16 | Ransomware | — |
| 2023-06-13 | CVE-2023-27997 | FortiOS and FortiProxy SSL-VPN Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests. | 2023-07-04 | Ransomware | — |
| 2023-03-14 | CVE-2022-41328 | FortiOS Fortinet FortiOS contains a path traversal vulnerability that may allow a local privileged attacker to read and write files via crafted CLI commands. | 2023-04-04 | — | |
| 2022-12-13 | CVE-2022-42475 | FortiOS Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted reque… | 2023-01-03 | Ransomware | — |
| 2022-10-11 | CVE-2022-40684 | Multiple Products Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially craf… | 2022-11-01 | Ransomware | — |
| 2022-09-08 | CVE-2018-13374 | FortiOS and FortiADC Fortinet FortiOS and FortiADC contain an improper access control vulnerability that allows attackers to obtain the LDAP server login credentials configured in FortiGate by pointing a LDAP server connectivity test requ… | 2022-09-29 | Ransomware | — |
| 2022-01-10 | CVE-2018-13383 | FortiOS and FortiProxy A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users. | 2022-07-10 | Ransomware | — |
| 2022-01-10 | CVE-2018-13382 | FortiOS and FortiProxy An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password. | 2022-07-10 | Ransomware | — |
| 2021-12-10 | CVE-2021-44168 | FortiOS Fortinet FortiOS "execute restore src-vis" downloads code without integrity checking, allowing an attacker to arbitrarily download files. | 2021-12-24 | — | |
| 2021-11-03 | CVE-2020-12812 | FortiOS Fortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to login successfully without being prompted for the second factor of authentication (FortiToken) if they change the cas… | 2022-05-03 | Ransomware | — |
| 2021-11-03 | CVE-2019-5591 | FortiOS Fortinet FortiOS contains a default configuration vulnerability that may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the Lightweight Directory Access Protoc… | 2022-05-03 | Ransomware | — |
| 2021-11-03 | CVE-2018-13379 | FortiOS Fortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests. | 2022-05-03 | Ransomware | — |
Fonte: catalogo CISA Known Exploited Vulnerabilities (dati pubblici). Le descrizioni sono di CISA, abbreviate. Verifica sempre l'advisory del vendor prima di intervenire. cisa.gov
Prima della patch: tre verifiche
- 01Confronta la versione e la configurazione esatte che usi con l'advisory del vendor. Avere il prodotto non significa essere esposti.
- 02Verifica la raggiungibilità: una falla sfruttata su un'interfaccia raggiungibile da internet, o da una postazione compromessa, passa in testa alla coda.
- 03Dove CISA indica il triage forense, oltre alla patch cerca tracce di compromissione: la correzione non elimina un attaccante entrato prima.
Domande
Quante vulnerabilità Fortinet ci sono nel catalogo CISA KEV?
32 nella versione 2026.10.21 del catalogo, la prima aggiunta il 2021-11-03 e la più recente il 2026-10-16. 12 sono state aggiunte negli ultimi 12 mesi.
Quali prodotti Fortinet hanno più vulnerabilità sfruttate?
Per numero di voci KEV: FortiOS (9), Multiple Products (7), FortiOS and FortiProxy (4), FortiClient EMS (3), FortiWeb (3), FortiSandbox (2).
Le vulnerabilità Fortinet sono usate negli attacchi ransomware?
CISA indica 14 delle 32 voci Fortinet come note per l'uso in campagne ransomware. Nella tabella sono segnalate.
La prossima CVE Fortinet è sfruttabile nella tua rete?
Una voce KEV dice che una vulnerabilità è sfruttata da qualche parte. Zero Hunt risponde se è sfruttabile nel tuo ambiente: un red team AI autonomo su un'appliance on-premise, con AI privata, in black box o gray box e con una persona che approva ogni passo che conta.
Altri vendor: Cisco · Microsoft · Linux kernel · Citrix · GitLab · Adobe · Palo Alto Networks · Check Point · Langflow · Arista · Oracle · SonicWall · Ivanti · VMware · Zimbra · SAP · Atlassian · Zyxel · Progress · F5