fortinet has 160 CVEs on record between 2019 and 2026. Disclosure cadence is accelerating: 32 in the last 90 days against 16 in the 90 before. The busiest recent month was December 2025 with 18. The median CVSS is 6.5 (medium), with 19 rated critical. 10% have been exploited in the wild, in line with the corpus average. The median gap from publication to a KEV listing is 93 days (15 cases). The dominant weakness classes are CWE-78 (12) and CWE-22 (11). Most affected products: FortiOS (38), FortiProxy (21), FortiAnalyzer (12).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 10% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- 93 d median(15)
- Last 90 days
- 32 prev 16
Products
- FortiOS 38
- FortiProxy 21
- FortiAnalyzer 12
- FortiSandbox 11
- FortiWeb 8
- FortiManager 7
Worst active — by depth score
CVE-2024-55591Critical· 9.8An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain supe…100CVE-2024-21762Critical· 9.8A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7…100CVE-2023-27997Critical· 9.8A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, versio…100CVE-2022-40684Critical· 9.8An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 …100CVE-2026-39808Critical· 9.8A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector…98
fortinet vulnerabilities
CVEs affecting fortinet, newest first. Open any entry for full detail, references, and exploit status.
160 CVEsRSS
CVE-2022-42472Medium· 4.0A improper neutralization of crlf sequences in http headers ('http response splitting') vulnerability in Fortinet FortiOS 7.2.0 through 7.2.2, FortiOS 7.0.0 through 7.0.8, FortiOS 6.4.0 through 6.4.12, FortiOS 6.2 all versions, FortiOS 6…
A improper neutralization of crlf sequences in http headers ('http response splitting') vulnerability in Fortinet FortiOS 7.2.0 through 7.2.2, FortiOS 7.0.0 through 7.0.8, FortiOS 6.4.0 through 6.4.12, FortiOS 6.2 all versions, FortiOS 6…
CVE-2022-40684Critical· 9.8CISA KEV0dayPoCAn authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 …
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 …
CVE-2020-12811Medium· 5.3A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable
A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable
CVE-2019-5591Medium· 6.5CISA KEVPoCA Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server.
A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server.
CVE-2020-12812Critical· 9.8CISA KEVPoC⚖ disputedAn improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if t…
An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if t…
CVE-2020-9290High· 7.3A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable
A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable
CVE-2020-9287High· 7.7A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable
A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable
CVE-2019-6693Medium· 6.5CISA KEVPoCUse of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementio…
CVE-2019-5589High· 8.8A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable
A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable
CVE-2018-13374Medium· 4.3CISA KEVPoCA Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connecti…
A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connecti…