Fortinet CVE-2026-21643

An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an

Fortinet FortiWeb contains a relative path traversal allowing unauthenticated attackers to execute administrative comman

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote

A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, versi

Fortinet FortiWeb contains an authenticated OS command injection allowing privilege escalation to execute unauthorized c

FortiOS SSL-VPN contains an improper authentication vulnerability that allows users to bypass two-factor authentication

Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet a

Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9

OS command injection in Fortinet FortiSandbox 4.4.0-4.4.8 and FortiSandbox PaaS versions 21.3-23.4 enables remote unauth

Remote code execution in Fortinet FortiClientEMS versions 7.4.5 through 7.4.6 allows unauthenticated attackers to execut