Vulnerabilities by vendor · updated on every deploy
Fortinet vulnerabilities: exploited CVEs and our analysis
Fortinet has 32 vulnerabilities in CISA's Known Exploited Vulnerabilities catalog, 12 of them added in the last 12 months and 14 known to be used in ransomware campaigns. Below: the 6 analyses Zero Hunt Research published on Fortinet products, then the catalog entries newest first with the federal due date.
CISA catalog version 2026.10.21, released 2026-10-21 14:04 UTC.
32
CVEs in CISA KEV
12
Added in the last 12 months
14
Known ransomware use
6
Zero Hunt analyses
Products with the most KEV entries: FortiOS (9) · Multiple Products (7) · FortiOS and FortiProxy (4) · FortiClient EMS (3) · FortiWeb (3) · FortiSandbox (2)
Our analysis of Fortinet vulnerabilities
2026-10-19
PEERSTITCH FortiGate implant: CVE-2025-61624 and a 25-month telecom breachA memory-only FortiGate implant, PEERSTITCH, hid in a telecom for ~25 months. CVE-2025-61624 is KEV, due today — and patching alone will not close it.
2026-10-02
FortiMail CVE-2026-104286: unauthenticated file write exploited as a zero-dayFortinet FortiMail CVE-2026-104286 is an unauthenticated path-traversal file write, CVSS 9.8, exploited in the wild to implant a backdoor. Patch and hunt.
2026-07-18
FortiSandbox CVE-2026-25089: Unauth RCE in the Box That Judges Your MalwareTwo unauthenticated RCE flaws (CVE-2026-25089, CVE-2026-39808, CVSS 9.8) hand attackers Fortinet FortiSandbox — the appliance that issues malware verdicts to your whole fabric. CISA KEV, exploited in the wild.
2026-06-20
FortiBleed: 74,000 Fortinet Firewalls Leaked and Nothing to PatchFortiBleed leaked working VPN credentials for ~74,000 Fortinet firewalls in 194 countries. No CVE to patch — the attacker logs in as a valid admin, and scanners see nothing.
2026-06-17
FortiSandbox CVE-2026-39808: The Security Appliance Nobody WatchesTwo FortiSandbox flaws (CVE-2026-39808, CVE-2026-39813) patched in April are now exploited in the wild. Why agentless security appliances are a detection blind spot — and how to catch their compromise.
2026-05-31
FortiClient EMS CVE-2026-35616: when the security vendor's management plane ships the malwareThe EKZ infostealer arrived on managed endpoints disguised as a Fortinet patch — pushed through the FortiClient EMS API after an unauthenticated bypass. Two months between disclosure and active campaign, and Fortinet still hasn't published IOCs.
All 32 KEV entries
| Added | CVE | Product and vulnerability | Federal due date | Flags | Our analysis |
|---|---|---|---|---|---|
| 2026-10-16 | CVE-2025-61624 | Multiple Products FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary… | 2026-10-19 | Forensic triage | Read → |
| 2026-10-01 | CVE-2026-104286 | FortiMail Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via… | 2026-10-04 | Forensic triage | Read → |
| 2026-09-09 | CVE-2025-25249 | Multiple Products Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets. | 2026-09-12 | Forensic triage | — |
| 2026-07-27 | CVE-2025-68686 | FortiOS Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency m… | 2026-08-10 | — | |
| 2026-07-16 | CVE-2026-39808 | FortiSandbox Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests. | 2026-07-19 | Forensic triage | Read → |
| 2026-07-16 | CVE-2026-25089 | FortiSandbox Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP req… | 2026-07-19 | Forensic triage | Read → |
| 2026-04-13 | CVE-2026-21643 | FortiClient EMS Fortinet FortiClient EMS contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests. | 2026-04-16 | — | |
| 2026-04-06 | CVE-2026-35616 | FortiClient EMS Fortinet FortiClient EMS contains an improper access control vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests. | 2026-04-09 | Read → | |
| 2026-01-27 | CVE-2026-24858 | Multiple Products Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authentication bypass using an alternate path or channel that could allow an attacker with a FortiCloud account and a registered device to log i… | 2026-01-30 | — | |
| 2025-12-16 | CVE-2025-59718 | Multiple Products Fortinet FortiOS, FortiSwitchMaster, FortiProxy, and FortiWeb contain an improper verification of cryptographic signature vulnerability that may allow an unauthenticated attacker to bypass the FortiCloud SSO login aut… | 2025-12-23 | — | |
| 2025-11-18 | CVE-2025-58034 | FortiWeb Fortinet FortiWeb contains an OS command Injection vulnerability that may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands. | 2025-11-25 | — | |
| 2025-11-14 | CVE-2025-64446 | FortiWeb Fortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests. | 2025-11-21 | — | |
| 2025-07-18 | CVE-2025-25257 | FortiWeb Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests. | 2025-08-08 | — | |
| 2025-06-25 | CVE-2019-6693 | FortiOS Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key. | 2025-07-16 | Ransomware | — |
| 2025-05-14 | CVE-2025-32756 | Multiple Products Fortinet FortiFone, FortiVoice, FortiNDR and FortiMail contain a stack-based overflow vulnerability that may allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted HTTP requests. | 2025-06-04 | — | |
| 2025-03-18 | CVE-2025-24472 | FortiOS and FortiProxy Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests. | 2025-04-08 | Ransomware | — |
| 2025-01-14 | CVE-2024-55591 | FortiOS and FortiProxy Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that may allow an unauthenticated, remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module. | 2025-01-21 | Ransomware | — |
| 2024-10-23 | CVE-2024-47575 | FortiManager Fortinet FortiManager contains a missing authentication vulnerability in the fgfmd daemon that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests. | 2024-11-13 | — | |
| 2024-10-09 | CVE-2024-23113 | Multiple Products Fortinet FortiOS, FortiPAM, FortiProxy, and FortiWeb contain a format string vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests. | 2024-10-30 | — | |
| 2024-03-25 | CVE-2023-48788 | FortiClient EMS Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an unauthenticated attacker to execute commands as SYSTEM via specifically crafted requests. | 2024-04-15 | Ransomware | — |
| 2024-02-09 | CVE-2024-21762 | FortiOS Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remote unauthenticated attacker to execute code or commands via specially crafted HTTP requests. | 2024-02-16 | Ransomware | — |
| 2023-06-13 | CVE-2023-27997 | FortiOS and FortiProxy SSL-VPN Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests. | 2023-07-04 | Ransomware | — |
| 2023-03-14 | CVE-2022-41328 | FortiOS Fortinet FortiOS contains a path traversal vulnerability that may allow a local privileged attacker to read and write files via crafted CLI commands. | 2023-04-04 | — | |
| 2022-12-13 | CVE-2022-42475 | FortiOS Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted reque… | 2023-01-03 | Ransomware | — |
| 2022-10-11 | CVE-2022-40684 | Multiple Products Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially craf… | 2022-11-01 | Ransomware | — |
| 2022-09-08 | CVE-2018-13374 | FortiOS and FortiADC Fortinet FortiOS and FortiADC contain an improper access control vulnerability that allows attackers to obtain the LDAP server login credentials configured in FortiGate by pointing a LDAP server connectivity test requ… | 2022-09-29 | Ransomware | — |
| 2022-01-10 | CVE-2018-13383 | FortiOS and FortiProxy A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users. | 2022-07-10 | Ransomware | — |
| 2022-01-10 | CVE-2018-13382 | FortiOS and FortiProxy An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password. | 2022-07-10 | Ransomware | — |
| 2021-12-10 | CVE-2021-44168 | FortiOS Fortinet FortiOS "execute restore src-vis" downloads code without integrity checking, allowing an attacker to arbitrarily download files. | 2021-12-24 | — | |
| 2021-11-03 | CVE-2020-12812 | FortiOS Fortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to login successfully without being prompted for the second factor of authentication (FortiToken) if they change the cas… | 2022-05-03 | Ransomware | — |
| 2021-11-03 | CVE-2019-5591 | FortiOS Fortinet FortiOS contains a default configuration vulnerability that may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the Lightweight Directory Access Protoc… | 2022-05-03 | Ransomware | — |
| 2021-11-03 | CVE-2018-13379 | FortiOS Fortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests. | 2022-05-03 | Ransomware | — |
Source: CISA Known Exploited Vulnerabilities catalog (public data). Descriptions are CISA's, shortened. Always check the vendor advisory before acting. cisa.gov
Before you patch: three checks
- 01Match the exact version and configuration you run against the vendor advisory. Owning the product is not the same as being exposed.
- 02Check reachability: an exploited flaw on an interface reachable from the internet, or from a compromised workstation, moves to the front of the queue.
- 03Where CISA flags forensic triage, hunt for compromise as well as patch: a fix does not remove an attacker who got in before it.
Questions
How many Fortinet vulnerabilities are in the CISA KEV catalog?
32 in catalog version 2026.10.21, the first added on 2021-11-03 and the most recent on 2026-10-16. 12 were added in the last 12 months.
Which Fortinet products have the most exploited vulnerabilities?
By KEV entries: FortiOS (9), Multiple Products (7), FortiOS and FortiProxy (4), FortiClient EMS (3), FortiWeb (3), FortiSandbox (2).
Are Fortinet vulnerabilities used in ransomware attacks?
CISA marks 14 of the 32 Fortinet entries as known to be used in ransomware campaigns. The table flags them.
Is the next Fortinet CVE exploitable on your network?
A KEV entry says a vulnerability is exploited somewhere. Zero Hunt answers whether it is exploitable in your environment: an autonomous AI red team on an on-premise appliance, running on private AI, black-box or gray-box, with a human approving every step that matters.
Other vendors: Cisco · Microsoft · Linux kernel · Citrix · GitLab · Adobe · Palo Alto Networks · Check Point · Langflow · Arista · Oracle · SonicWall · Ivanti · VMware · Zimbra · SAP · Atlassian · Zyxel · Progress · F5