Fortinet
Monthly
Path traversal vulnerability in Fortinet FortiAnalyzer and FortiManager (versions 7.0 through 7.6.4, including Cloud variants) allows privileged local attackers to delete arbitrary files from the underlying filesystem via crafted CLI requests. The vulnerability affects both on-premises and cloud deployments across multiple major versions. CVSS 6.0 reflects moderate integrity and availability impact, constrained by requirement for high-privilege CLI access and local attack vector.
Open redirect vulnerability in Fortinet FortiNAC-F allows authenticated system administrators to redirect users to arbitrary websites through crafted CSV file uploads. Affects FortiNAC-F 7.6.0-7.6.5, all 7.4.x, and all 7.2.x versions. The attack requires high privilege level (system administrator role) and user interaction (UI:R), resulting in low real-world impact despite network-accessible attack vector. No public exploit code or active exploitation confirmed.
SQL injection in Fortinet FortiAnalyzer and FortiManager versions 7.0-7.6 allows privileged authenticated attackers to execute unauthorized code or commands via the JSON RPC API. This affects both on-premises and cloud variants across multiple major version branches (7.0, 7.2, 7.4, 7.6). The vulnerability requires high-privilege authentication (CVSS PR:H) but is remotely exploitable with low attack complexity. No public exploit identified at time of analysis, though the network attack vector and code execution capability make this a priority for organizations running affected Fortinet management infrastructure.
Fortinet FortiSOAR (both PaaS and on-premise versions 7.3-7.6.3) contains a path traversal vulnerability in File Content Extraction actions that allows authenticated remote attackers to read arbitrary files outside the intended directory with high confidentiality impact. The vulnerability requires valid credentials and is exploitable over the network with no user interaction; CVSS 6.5 reflects medium-to-high severity for a cloud security platform handling sensitive workflows.
Reflected cross-site scripting (XSS) in Fortinet FortiSandbox and FortiSandbox PaaS versions 5.0.0 through 5.0.4 allows unauthenticated remote attackers to inject malicious scripts via crafted HTTP requests. Exploitation requires user interaction (clicking a malicious link), resulting in session hijacking, credential theft, or malware distribution to administrators accessing the FortiSandbox web interface. No public exploit code or active exploitation has been confirmed at time of analysis.
Hard-coded cryptographic keys in Fortinet FortiClientEMS 7.4.0 through 7.4.5 allow local authenticated attackers with high privileges to disclose sensitive information and potentially modify system configurations. An attacker with administrative access can extract or leverage these embedded keys to compromise confidentiality and integrity of protected data. This vulnerability requires local access and elevated privileges, limiting but not eliminating real-world risk in multi-user or compromised endpoint scenarios.
Denial of service in Fortinet FortiWeb 7.0-8.0.3 via integer overflow allows authenticated remote attackers with high privileges to crash the application, resulting in service unavailability. The vulnerability has a CVSS score of 4.9 (Medium) and affects multiple FortiWeb versions across a wide range. No public exploit code or active exploitation has been confirmed at the time of analysis.
An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.8, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions, FortiNDR. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Stored cross-site scripting (XSS) in Fortinet FortiSandbox and FortiSandbox PaaS versions 4.2 through 5.0.5 allows authenticated administrators with high privileges to inject malicious scripts into web pages, leading to unauthorized code execution when other users interact with compromised content. The vulnerability requires user interaction (UI:R) and affects confidentiality and integrity but not availability. With a CVSS score of 4.8 and high privilege requirement (PR:H), this represents a moderate risk primarily to multi-user deployments where administrative accounts may be compromised or untrusted.
Local privilege escalation in Fortinet FortiWeb 7.0.10-8.0.2 allows high-privileged local attackers to execute arbitrary code or commands through relative path traversal, exploiting improper file path validation with CVSS 6.7 (high confidentiality, integrity, and availability impact). No public exploit code or active exploitation confirmed at time of analysis.
Path traversal vulnerability in Fortinet FortiSandbox allows privileged super-admin users with CLI access to delete arbitrary directories on the system via crafted HTTP requests. Affects FortiSandbox 5.0.0-5.0.5, 4.4.0-4.4.8, 4.2 all versions, FortiSandbox Cloud 5.0.4, and FortiSandbox PaaS 5.0.4. CVSS 6.7 reflects high integrity and availability impact but requires authenticated super-admin privileges; no public exploit code or active KEV designation identified at time of analysis.
Server-side request forgery in Fortinet FortiSOAR (both PaaS and on-premise versions 7.3 through 7.6.4) allows authenticated attackers to discover services running on local ports by crafting malicious requests. The vulnerability requires valid user credentials and carries a CVSS score of 4.3 with low confidentiality impact; no public exploit code or active exploitation has been confirmed at this time.
Fortinet FortiSOAR (both PaaS and on-premise versions 7.3-7.6.x) transmits sensitive authentication credentials in cleartext in API responses for Secure Message Exchange and RADIUS configurations, allowing authenticated attackers with network access to intercept and view passwords. The vulnerability requires user interaction (UI:R) and prior authentication (PR:L), affecting confidentiality of stored credentials in these integrations with a CVSS score of 5.7.
Fortinet FortiSOAR stores LDAP service account passwords in a recoverable format, allowing authenticated high-privilege remote attackers to retrieve plaintext or weakly protected credentials by modifying the LDAP server address in configuration. This affects FortiSOAR PaaS and on-premise versions 7.3 through 7.6.4. The vulnerability requires high-level administrative authentication and poses a confidentiality risk to stored credentials, with no evidence of active exploitation or public exploit code at time of analysis.
Stored cross-site scripting (XSS) in Fortinet FortiSOAR allows authenticated remote attackers to inject malicious scripts via crafted HTTP requests, affecting both PaaS and on-premise deployments across versions 7.3 through 7.6.3. The vulnerability requires user interaction to trigger the payload and results in limited confidentiality and integrity impact, with a CVSS score of 4.6 reflecting the authentication requirement and user-interaction dependency. No public exploit code or active exploitation has been confirmed at the time of analysis.
Unauthorized code or command execution can be triggered on unpatched Fortinet FortiOS appliances by an unauthenticated attacker who already holds an adjacent-network position and sends specially crafted packets to a critical function that lacks an authentication check. Affected branches include FortiOS 7.6.0 through 7.6.3, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11, 7.0.0 through 7.0.17, all 6.4 versions, and 6.2.9 through 6.2.17; no public exploit has been identified at time of analysis, EPSS is very low at 0.01 percent, and SSVC records Exploitation none and Automatable no. The CVSS 8.8 base score reflects high confidentiality, integrity, and availability impact once adjacency is achieved, but the AV:A precondition and lack of observed exploitation keep immediate internet-facing risk below the headline score.
Fortinet FortiSOAR PaaS and on-premise versions 7.3 through 7.6.4 store connector passwords in a recoverable format, allowing authenticated remote attackers to retrieve plaintext or weakly encrypted credentials for multiple installed connectors by modifying the server address in connector configuration. This affects security orchestration workflows that depend on connector authentication for external integrations.
Insufficiently protected credentials in Fortinet FortiSandbox 5.0.0-5.0.5, 4.4.x, and FortiSandbox PaaS 5.0.1-5.0.5 allow authenticated administrators to read LDAP server credentials via client-side inspection. This low-severity information disclosure requires high-privilege authentication and network access, exposing only credential confidentiality without enabling modification or denial of service.
SQL injection in Fortinet FortiClientEMS 7.0 through 7.4.5 allows high-privileged local attackers to execute unauthorized code or commands with high integrity and confidentiality impact. The vulnerability requires local access and high privileges (PR:H per CVSS vector), making it a risk primarily in environments where administrative users are untrusted or compromised. CISA SSVC framework rates this as non-exploitable via automation due to privilege requirements, though the technical impact is total (confidentiality, integrity, and availability compromise). No public exploit code has been identified at the time of analysis.
Remote code execution in Fortinet FortiWeb versions 7.0 through 8.0.3 stems from a stack-based buffer overflow that authenticated attackers can exploit by sending crafted HTTP requests, provided they can bypass stack protection and ASLR mechanisms. Successful exploitation allows attackers to execute arbitrary code with the privileges of the vulnerable application. No patch is currently available for this medium-severity vulnerability affecting multiple FortiWeb releases.
FortiSIEM 7.3.0-7.3.4 and 7.4.0 are vulnerable to reflected cross-site scripting that allows unauthenticated remote attackers to inject malicious scripts through URL parameters, enabling social engineering attacks against users who click malicious links. The vulnerability requires user interaction to trigger but has no authentication requirements, making it practical for phishing campaigns that redirect victims to spoofed pages.
Fortinet FortiDeceptor versions 4.0 through 6.2.0 are vulnerable to argument injection that allows authenticated super-admin users with CLI access to delete sensitive files through crafted HTTP requests. The vulnerability requires high-level privileges and direct CLI access to exploit, limiting the attack surface to trusted administrators. No patch is currently available for this issue.
A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow an authenticated attacker to crash the HTTP daemon via crafted HTTP requests. [CVSS 2.7 LOW]
Arbitrary code execution in Fortinet FortiWeb 7.0.2 through 8.0.2 stems from a stack-based buffer overflow triggered by crafted HTTP requests from authenticated attackers who can bypass stack protection mechanisms. The vulnerability affects multiple FortiWeb versions and requires high privileges and specific conditions to exploit, though no patch is currently available. An authenticated attacker with sufficient privileges could leverage this flaw to execute arbitrary commands on affected systems.
An improper restriction of excessive authentication attempts vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4 all versions, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all versions, FortiAnalyzer Cloud 7.6.0 through 7.6.4, FortiAnalyzer Cloud 7.4 all versions, FortiAnalyzer Cloud 7.2 all versions, FortiAnalyzer Cloud 7.0 all versions, FortiAnalyzer Cloud 6.4 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4 all...
Fortinet FortiSwitchAXFixed versions 1.0.0 through 1.0.1 contain an access control flaw that allows authenticated administrators to execute arbitrary system commands by uploading a malicious SSH configuration file. The vulnerability requires local access and valid admin credentials but poses a risk to organizations where admin accounts may be compromised or where insider threats are a concern. No patch is currently available.
A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer Cloud 7.6.0 through 7.6.4, FortiAnalyzer Cloud 7.4.0 through 7.4.7, FortiAnalyzer Cloud 7.2 all versions, FortiAnalyzer Cloud 7.0 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.7, FortiManager 7.2 all versions, FortiManager 7.0 all versions, Fort...
A improper certificate validation vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.8, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.8, FortiManager 7.2 all versions, FortiManager 7.0 all versions, FortiManager 6.4 all versions may allow a remote unauthenticated attacker to view confidential information via a man in the middle [MiTM] attack. [CVSS 6.9 MEDIUM]
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.11, FortiWeb 7.2.0 through 7.2.12, FortiWeb 7.0.0 through 7.0.12 may allow an authenticated attacked to execute arbitrary commands via a specialy crafted HTTP request. [CVSS 7.2 HIGH]
A cleartext storage of sensitive information vulnerability [CWE-312] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0 through 7.4.4, FortiMail 7.2.0 through 7.2.7, FortiMail 7.0.0 through 7.0.8, FortiRecorder 7.2.0 through 7.2.3, FortiRecorder 7.0 all versions, FortiRecorder 6.4 all versions, FortiVoice 7.2.0, FortiVoice 7.0.0 through 7.0.6 may allow an authenticated malicious administrator to obtain user's secrets via CLI commands. Practical exploitability is limited ...
A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiManager 7.4.0 through 7.4.2, FortiManager 7.2.0 through 7.2.10, FortiManager 6.4 all versions may allow a remote unauthenticated attacker to execute unauthorized commands via crafted requests, if the service is enabled. [CVSS 8.1 HIGH]
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] vulnerability in Fortinet FortiSOAR Agent Communication Bridge 1.1.0, FortiSOAR Agent Communication Bridge 1.0 all versions may allow an unauthenticated attacker to read files accessible to the fortisoar user on a system where the agent is deployed, via sending a crafted request to the agent port. [CVSS 5.8 MEDIUM]
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an authenticated privileged attacker to execute code via crafted requests. [CVSS 4.8 MEDIUM]
An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all versions, FortiAnalyzer-BigData 7.6.0, FortiAnalyzer-BigData 7.4.0 through 7.4.4, FortiAnalyzer-BigData 7.2 all versions, FortiAnalyzer-BigData 7.0 all versions, FortiAnalyzer-BigData 6.4 all versions, FortiAnalyzer-BigData 6.2 all versions may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted requests. [CVSS 6.0 MEDIUM]
An authentication bypass by spoofing vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.8, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow a remote unauthenticated attacker to bypass hostname restrictions via a specially crafted request. [CVSS 5.3 MEDIUM]
A hidden functionality vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.3, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2.0 through 7.2.10, FortiAnalyzer 7.0.0 through 7.0.14, FortiAnalyzer 6.4 all versions, FortiAnalyzer Cloud 7.6.2, FortiAnalyzer Cloud 7.4.1 through 7.4.7, FortiAnalyzer Cloud 7.2.1 through 7.2.10, FortiAnalyzer Cloud 7.0.1 through 7.0.14, FortiAnalyzer Cloud 6.4 all versions, FortiManager 7.6.0 through 7.6.3, FortiManager 7.4.0 through 7.4.7, FortiManager 7.2.0 through 7.2.10, FortiManager 7.0.0 through 7.0.14, FortiManager 6.4 all versions, FortiManager Cloud 7.6.2 through 7.6.3, FortiManager Cloud 7.4.1 through 7.4.7, FortiManager Cloud 7.2.1 through 7.2.10, FortiManager Cloud 7.0.1 through 7.0.14, FortiManager Cloud 6.4 all versions may allow a remote authenticated read-only admin with CLI access to escalate their privilege via use of a hidden command. [CVSS 6.7 MEDIUM]
A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0 all versions allows an authenticated admin to execute unauthorized code or commands via specifically crafted configuration. [CVSS 6.7 MEDIUM]
Forticlient versions up to 7.4.4 is affected by improper link resolution before file access (CVSS 7.1).
vulnerability in Fortinet FortiOS 7.6.0 versions up to 7.6.4 contains a vulnerability that allows attackers to an authenticated user with knowledge of FSSO policy configurations to gain unaut (CVSS 4.2).
An inconsistent interpretation of http requests ('http request smuggling') vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4.3 through 6.4.16 may allow an unauthenticated attacker to smuggle an unlogged http request through the firewall policies via a specially crafted header [CVSS 5.8 MEDIUM]
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an unauthenticated attacker to execute commands via crafted requests. [CVSS 8.8 HIGH]
Fortinet FortiOS versions up to 7.6.6 contains a vulnerability that allows attackers to decrypt LDAP credentials stored in device configuration files, as exploited in t (CVSS 3.2).
A Server-Side Request Forgery (SSRF) vulnerability [CWE-918] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.4, FortiSandbox 4.4 all versions, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an authenticated attacker to proxy internal requests limited to plaintext endpoints only via crafted HTTP requests. [CVSS 3.8 LOW]
Fortinet FortiSIEM (6.7.0 through 7.4.0) has OS command injection via crafted TCP requests. As a SIEM, compromise gives attackers access to all security logs and the ability to suppress alerts. PoC available.
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.4, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2.0 through 7.2.10, FortiClientEMS 7.0 all versions may allow an authenticated attacker with at least read-only admin permission to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests. [CVSS 7.2 HIGH]
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 through 7.0.7 allows a privileged attacker to delete files from the underlying filesystem via crafted HTTP or HTTPs requests. [CVSS 6.5 MEDIUM]
Fortinet FortiFone 7.0.0-7.0.1 and 3.0.13-3.0.23 allows unauthenticated attackers to download the complete device configuration via crafted HTTP/HTTPS requests. Configuration files contain credentials and network settings.
FortiWeb appliances running versions 8.0.0-8.0.1, 7.6.0-7.6.5, 7.4.0-7.4.10, 7.2.0-7.2.11, or 7.0.0-7.0.11 accept a stored password hash as a direct authentication credential, enabling an attacker who has obtained a valid hash out-of-band (e.g., from a leaked configuration or backup) to authenticate as that user via crafted HTTP/HTTPS requests without knowing the cleartext password. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (base 7.5 HIGH) indicates a network-reachable, low-complexity, unauthenticated flaw with high integrity impact; the primary hurdle is acquiring the hash, and the primary exposure is a network-reachable FortiWeb management interface. No public exploit identified at time of analysis.
Unauthenticated remote attackers who already know a target FortiWeb appliance's serial number can forge a cookie that the device accepts without integrity checking, allowing arbitrary operations through a single crafted HTTP or HTTPS request. Affected releases are FortiWeb 8.0.0 through 8.0.1, 7.6.0 through 7.6.5, 7.4.0 through 7.4.10, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.11; no public exploit code has been identified and the flaw is not listed in CISA KEV at time of analysis. CVSS 3.1 scores this 8.1 with AC:H solely because of the serial-number prerequisite, which narrows opportunistic mass exploitation but does not protect a targeted attacker who can obtain or enumerate the serial, so this remains a real priority despite that mitigating access-complexity factor.
Authenticated attackers with administrative privileges can exploit a SQL injection flaw in Fortinet FortiVoice to execute unauthorized code or commands, per Fortinet PSIRT advisory FG-IR-25-362. Affected versions include FortiVoice 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, and all 6.4 and 6.0 releases. The CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects network reachability with low complexity but requires high privileges, limiting realistic risk to insider abuse or post-compromise escalation; no public exploit identified at time of analysis.
OS command injection in Fortinet FortiExtender firmware lets an attacker who already holds a high-privilege administrative session run arbitrary operating-system commands on the device by sending a crafted HTTP request to the management interface. All builds of 7.0.x and 7.2.x are affected along with 7.4.0 through 7.4.7 and 7.6.0 through 7.6.3, and successful exploitation yields full compromise of confidentiality, integrity, and availability (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Exploitation is gated behind admin authentication, so only administrators or attackers who have already stolen admin credentials/sessions can trigger it; no public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is 1.71% (77th percentile).
Insufficient session expiration in Fortinet FortiOS SSLVPN allows an attacker who already holds an active SSLVPN session to retain access to network resources after the associated user account's password is changed, because FortiOS does not terminate the pre-existing session at the moment of the password change. Affected builds are FortiOS 7.4.0 and all releases of 7.2, 7.0, and 6.4, in deployments where the SSLVPN feature is enabled; units without SSLVPN are not exposed. The issue is rated CVSS 5.6 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) with an EPSS of 0.30% (21st percentile); no public exploit was identified at time of analysis, and there is no CISA KEV entry. The practical risk is moderate and context-dependent rather than a top-tier priority, because the triggering password change is a victim or administrator action the attacker cannot force (reflected in AC:H) and the behavior manifests only under particular conditions outside the attacker's control.
Arbitrary file write via path traversal in the FortiVoice web management interface (FortiVoice 7.0.0 through 7.0.7 and 7.2.0 through 7.2.2) lets a privileged authenticated operator escape the intended directory and drop files anywhere on the appliance using crafted HTTP/HTTPS commands, which on an appliance realistically escalates to remote code execution and full device compromise. NVD rates the flaw 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), while independent review revises the privilege prerequisite to PR:H because the description explicitly describes a privileged attacker holding a valid management session. There is no evidence of active exploitation (the CVE is not in CISA KEV) and no public exploit code was identified at time of analysis; the dominant limiting factor is the requirement for authenticated, privileged access to the FortiVoice administrative interface.
Authenticated read-only administrators of Fortinet FortiAuthenticator can retrieve the messaging-service credentials of other administrators through crafted requests to the administrative interface. Affected builds are FortiAuthenticator 6.6.0 through 6.6.6 and all versions of 6.5, 6.4, and 6.3. Exploitation requires an existing admin account at read-only level, keeping overall risk low (CVSS 2.7, EPSS 0.21%); no public exploit identified at time of analysis.
Information disclosure in Fortinet FortiSOAR (PaaS and on-premise) 7.3, 7.4, 7.5.0-7.5.1, and 7.6.0-7.6.2 allows an authenticated attacker with a valid low-privileged account to read data they are not authorized to access by sending crafted requests to endpoints that fail to enforce proper access controls. Impact is limited to confidentiality (C:H) with no integrity or availability effect, and a valid account is mandatory (CVSS vector PR:L), so fully anonymous external attackers cannot exploit it. No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS is low (0.26%, 17th percentile), consistent with a moderate-severity, authenticated-only issue (CVSS 6.5).
FortiSOAR 7.3 through 7.6.2 (both PaaS and on-premise) permits an attacker who already has authenticated access to a victim's user account - via a valid session or stolen credentials - to change that account's password without supplying the current password (CWE-620), leading to account takeover or lockout of the legitimate user. This is a post-authentication flaw (CVSS PR:L) with no confidentiality impact (C:N) but high integrity and availability impact (I:H, A:H); the vendor scored attack complexity as high (AC:H) while our independent assessment rates it low (AC:L). No public exploit code or CISA KEV activity is known, and EPSS is low at 0.23% (13th percentile).
Authentication bypass in Fortinet FortiWeb 8.0.0, 7.6.0-7.6.4, and 7.4.0-7.4.9 allows unauthenticated remote attackers to circumvent FortiCloud SSO login by sending a crafted SAML response message. The flaw stems from improper cryptographic signature verification (CWE-347), enabling forgery of authentication assertions. No public exploit identified at time of analysis, EPSS sits at 0.26% (50th percentile), and the issue is not currently listed in CISA KEV, though Fortinet products have historically been high-value targets.
Fortinet FortiAuthenticator 6.6.0 through 6.6.6, and all 6.5, 6.4, and 6.3 releases, allow an authenticated attacker holding at least the limited sponsor permission to read and download device logs by directly requesting specific endpoints that fail to enforce authorization (CWE-425, forced browsing). Impact is confined to confidentiality of device logs - there is no write capability and no availability impact - and the privilege gate plus the need to know the exact reachable endpoints keep realistic risk low. There is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis; EPSS is 0.23% (13th percentile), reinforcing the low-priority rating.
Authenticated low-privileged users can reboot shared FortiGate devices via crafted HTTP requests in FortiPortal 7.4.0 through 7.4.5 due to an incorrect authorization check (CWE-863). This availability-only flaw (CVSS 6.5) requires a valid portal session and a multi-tenant deployment where FortiGates are shared, limiting real-world exposure. No public exploit code or active exploitation has been identified at time of analysis, and EPSS is low at 0.31%.
Reflected cross-site scripting in Fortinet FortiSandbox (5.0.0 through 5.0.2, 4.4.0 through 4.4.7, and all versions of 4.2 and 4.0) allows an unauthenticated remote attacker to inject script into the appliance's web management interface via crafted HTTP requests. Exploitation is not automatable at scale: because the CVSS vector carries UI:R, the payload only fires if a logged-in administrator or operator is lured into opening the attacker-supplied request or link in their browser, and the resulting impact is confined to that victim's browser session (Low confidentiality and integrity, no availability impact). The flaw is rated CVSS 6.1 with an EPSS score of 6.31% (93rd percentile), indicating elevated likelihood relative to the broader CVE population, but there is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV).
OS command injection in Fortinet FortiSandbox allows an authenticated attacker with low-privilege credentials to execute arbitrary operating-system commands on the underlying appliance by sending crafted HTTP requests to the management interface, yielding full compromise of confidentiality, integrity, and availability (CVSS 8.8, CWE-78). Affected releases are FortiSandbox 5.0.0 through 5.0.2, 4.4.0 through 4.4.7, and all versions of the 4.2 and 4.0 branches, so any appliance still running those builds with reachable web management is in scope. Exploitation requires network access to the administrative interface plus valid low-privilege authentication (PR:L), meaning the risk concentrates in deployments that expose management to untrusted networks or broadly provision low-privilege accounts; no public exploit identified at time of analysis, though EPSS is elevated at 17.19% (97th percentile), signaling meaningful predicted exploitation activity.
Authenticated OS command injection in Fortinet FortiSandbox (versions 5.0.0-5.0.2, 4.4.0-4.4.7, all 4.2.x, all 4.0.x) and FortiSandbox Cloud (24.1 and all 23.x) allows a high-privileged remote attacker to execute arbitrary commands by sending crafted HTTP/HTTPS requests to the management interface. No public exploit identified at time of analysis and the issue is not currently listed in CISA KEV, but the breadth of affected major versions and the network-reachable attack surface make this a notable post-authentication risk for security appliance operators.
A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiADC 8.0.0, FortiADC 7.6.0 through 7.6.3, FortiADC 7.4 all versions, FortiADC 7.2 all. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A Cleartext Storage of Sensitive Information in Memory vulnerability [CWE-316] in Fortinet FortiPAM 1.6.0, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM. Rated medium severity (CVSS 4.2), this vulnerability is low attack complexity. No vendor patch available.
A use of hard-coded credentials vulnerability in Fortinet FortiWeb 7.6.0, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow an authenticated attacker with. Rated medium severity (CVSS 5.3), this vulnerability is low attack complexity. No vendor patch available.
An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 through 7.0.7. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS. Rated high severity (CVSS 7.5), this vulnerability is no authentication required. No vendor patch available.
An improper neutralization of crlf sequences ('crlf injection') vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 through 7.4.5, FortiMail 7.2 all versions, FortiMail 7.0 all. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiADC 7.4.0, FortiADC 7.2 all versions, FortiADC 7.1 all versions, FortiADC 7.0 all versions, FortiADC 6.2. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS. Rated low severity (CVSS 1.9). No vendor patch available.
An active debug code vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through 7.2.10, FortiClientWindows 7.0 all versions may allow a local attacker to run. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.
An Out-of-bounds Write vulnerability [CWE-787] in FortiADC 8.0.0, 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, 7.2 all versions, 7.1 all versions, 7.0 all versions, 6.2 all versions may allow an. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. No vendor patch available.
An Exposed IOCTL with Insufficient Access Control vulnerability [CWE-782] vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through 7.2.9 may allow an. Rated high severity (CVSS 7.8). No vendor patch available.
Authenticated local CLI users on affected FortiExtender firmware can trigger a classic buffer overflow by supplying crafted CLI commands, potentially executing arbitrary code or commands with high confidentiality, integrity, and availability impact. The issue affects FortiExtender 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, and all 7.2 and 7.0 versions; exploitation requires valid CLI credentials and local/management-plane access, and no public exploit was identified at time of analysis (EPSS 0.03%, 7th percentile).
A debug messages revealing unnecessary information vulnerability in Fortinet FortiExtender 7.6.0 through 7.6.1, FortiExtender 7.4.0 through 7.4.6, FortiExtender 7.2 all versions, FortiExtender 7.0. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
A Heap-based Buffer Overflow vulnerability [CWE-122] vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through 7.2.8 may allow an authenticated local IPSec. Rated high severity (CVSS 7.8). No vendor patch available.
An Improper Isolation or Compartmentalization vulnerability [CWE-653] in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Local privilege escalation in Fortinet's FortiDLP Agent for macOS lets an authenticated local attacker escalate to root by sending a crafted request to a local listening port exposed by the Outlookproxy plugin. The flaw is a path traversal (CWE-22) in which the plugin mishandles a pathname, allowing the attacker to reach files or operations outside the intended restricted directory under the agent's privileged context. The affected versions are 11.5.1, 11.4.2 through 11.4.6, 11.3.2 through 11.3.4, 11.2.0 through 11.2.3, 11.1.1 through 11.1.2, 11.0.1, 10.5.1, 10.4.0, and 10.3.1, on macOS endpoints only, and exploitation requires an existing local foothold (CVSS PR:L, AV:L, no user interaction). Per available intelligence there is no public exploit code, the vulnerability is not in CISA KEV, and EPSS is low at 0.21 percent (11th percentile), making this a credible but second-tier priority rather than an emergency.
Local privilege escalation in Fortinet's FortiDLP Agent on Windows (Outlookproxy plugin) allows an authenticated, low-privileged local user to elevate to the LocalService account by sending a crafted path-traversal request to the agent's local listening port. Affected builds include 11.5.1, 11.4.2 through 11.4.6, 11.3.2 through 11.3.4, 11.2.0 through 11.2.3, 11.1.1 through 11.1.2, 11.0.1, 10.5.1, 10.4.0 and 10.3.1, with CVSS 3.1 base 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the EPSS probability is low at roughly 0.21% (10th percentile), so this is a credible but not emergency-grade local escalation issue that requires an attacker to already hold a foothold on the host.
Local disclosure of a signed-in user's email information through the Outlookproxy plugin in Fortinet FortiDLP Agent on macOS and Windows, reachable only by an attacker who is already an authenticated administrator on the endpoint (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N, base 6.0, CWE-359). Affected releases are 11.5.1, 11.4.2 through 11.4.6, 11.3.2 through 11.3.4, 11.2.0 through 11.2.3, 11.1.1 through 11.1.2, 11.0.1, 10.5.1, 10.4.0 and 10.3.1. Because the vector requires local access and high privileges, the realistic threat is insider misuse or post-compromise lateral activity on a managed host rather than remote attack; no public exploit identified at time of analysis, no KEV listing, and EPSS is 0.18% (7th percentile).
Information disclosure in FortiDLP Agent 12.0.0 through 12.0.5, 11.5.1, 11.4.6, and 11.4.5 allows local users with low privileges to read enrollment codes improperly written to log files and reuse them, causing limited confidentiality and integrity impact. Exploitation requires local access and readable logs; no public exploit identified at time of analysis, and EPSS is low at 0.16% (4th percentile). Fortinet advisory FG-IR-25-160 is available, and this is a low-to-moderate priority issue despite being a Fortinet product.
Sensitive data exposure in Fortinet FortiADC lets an authenticated attacker with low privileges (PR:L) pull confidential information off the appliance by sending crafted HTTP or HTTPS requests to its web/management interface. Affected releases are 7.4.0, 7.2.3 and below, 7.1.4 and below, and all 7.0 and 6.2 versions; the flaw is not reachable by a fully unauthenticated actor, since a valid low-privilege session and network access to the interface are prerequisites. Impact is confidentiality-only (C:H/I:N/A:N) with no integrity or availability effect, no publicly available exploit code has been identified at time of analysis, and EPSS is low at 0.30% (21st percentile), making this a moderate-priority information-disclosure issue rather than an urgent one.
Authenticated denial-of-service in Fortinet FortiOS allows a high-privileged user to crash the HTTP daemon via a specially crafted API request. The root cause is an unchecked return value (CWE-252) that triggers a null pointer dereference in the HTTP daemon, resulting in a temporary service disruption. EPSS exploitation probability is 0.06% (20th percentile), no KEV listing, and no public exploit identified at time of analysis, placing this as low operational priority despite network-reachable attack vector.
System command execution on FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2.5 through 7.2.10, 7.0.0 through 7.0.15 and all 6.4 branches allows an authenticated attacker who already holds a high-privilege CLI session to escape the intended CLI restriction and run commands on the underlying operating system by issuing crafted commands (CWE-684). Because the vector is local (AV:L) with PR:H, this is not reachable by unauthenticated remote attackers and does not affect default remote-facing configurations. EPSS is 0.29% (19th percentile) and no public exploit identified at time of analysis; realistic risk is confined to environments where lower-trust or additional users are granted administrative CLI access, or where a privileged account is compromised.
Stored cross-site scripting (XSS) in FortiSIEM allows an attacker who already holds high (administrative-level) privileges on the platform to persist a crafted script into web-generated pages, which then executes in the browser of another authenticated user who loads the affected page. The flaw affects FortiSIEM 7.2.0 through 7.2.2 and all versions of 7.1, 7.0, 6.7, 6.6, 6.5, 6.4, 6.3 and 6.2, and is rated CVSS 4.8 with EPSS probability of 0.27% (18th percentile); per available intelligence there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV. Because exploitation demands prior admin-level access (PR:H) plus victim interaction (UI:R), this is a genuinely low-priority issue despite carrying a network attack vector - it is primarily relevant as an insider or post-compromise escalation and persistence primitive rather than a remotely exploitable unauthenticated attack.
Authenticated heap-based buffer overflow in FortiOS, FortiPAM, and FortiProxy RDP bookmark handling can allow a low-privileged user to execute unauthorized code. Affected deployments include FortiOS 7.6.2 and below, 7.4.7 and below, 7.2.10 and below, and all 7.0/6.4 branches; FortiPAM through 1.5.0; and FortiProxy 7.6.2/7.4.3 and below and all 7.2/7.0 branches. No public exploit identified at time of analysis, and EPSS is low at 0.08%, though CVSS 8.8 reflects high confidentiality, integrity, and availability impact once an attacker holds valid low-privilege credentials and can reach the RDP bookmark feature.
A local low-privileged Windows user can achieve DLL hijacking in the FortiClient Online Installer because the installer loads DLLs from a search path the user can write to, allowing a planted malicious DLL to run when the installer is executed. Affected builds are FortiClient Windows 7.4.0 through 7.4.3, 7.2.0 through 7.2.11, and all 7.0 releases when delivered via the Online Installer; per the CVSS vector the attack requires a local account (PR:L) and some form of user or deployment action to launch the installer (UI:R). Risk is tempered by a very low EPSS score of 0.18% (7th percentile), and no public exploit code has been identified and there is no CISA KEV entry indicating active exploitation; the assessor rates this as high-scored (7.3) but comparatively low-urgency because exploitation presupposes an existing local foothold and write access to the installer folder.
An unauthenticated race condition (CWE-362) in Fortinet FortiAnalyzer's FortiCloud SSO authorization logic lets a remote attacker attempt to win a timing-sensitive race and bypass SSO authorization by sending crafted, concurrent FortiCloud SSO requests. Affected builds are 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, and all versions before 7.0.13, and the flaw only matters where FortiCloud SSO is actually configured - deployments using purely local authentication are out of scope. Rated CVSS 5.3 (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N) with EPSS around 0.32% (22nd percentile), this is a moderate-severity, lower-priority issue rather than a top-tier emergency, and there is no public exploit identified at time of analysis.
Improper authorization in Fortinet FortiOS and FortiProxy lets an authenticated, low-privileged attacker read static files belonging to other VDOMs through crafted HTTP or HTTPS requests, but only when the device is configured in multi-VDOM mode and the management interface is reachable. Impact is limited to confidentiality of static files; integrity and availability are unaffected. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is 0.32% (23rd percentile), so this is a low-to-moderate priority issue.
Path traversal vulnerability in Fortinet FortiAnalyzer and FortiManager (versions 7.0 through 7.6.4, including Cloud variants) allows privileged local attackers to delete arbitrary files from the underlying filesystem via crafted CLI requests. The vulnerability affects both on-premises and cloud deployments across multiple major versions. CVSS 6.0 reflects moderate integrity and availability impact, constrained by requirement for high-privilege CLI access and local attack vector.
Open redirect vulnerability in Fortinet FortiNAC-F allows authenticated system administrators to redirect users to arbitrary websites through crafted CSV file uploads. Affects FortiNAC-F 7.6.0-7.6.5, all 7.4.x, and all 7.2.x versions. The attack requires high privilege level (system administrator role) and user interaction (UI:R), resulting in low real-world impact despite network-accessible attack vector. No public exploit code or active exploitation confirmed.
SQL injection in Fortinet FortiAnalyzer and FortiManager versions 7.0-7.6 allows privileged authenticated attackers to execute unauthorized code or commands via the JSON RPC API. This affects both on-premises and cloud variants across multiple major version branches (7.0, 7.2, 7.4, 7.6). The vulnerability requires high-privilege authentication (CVSS PR:H) but is remotely exploitable with low attack complexity. No public exploit identified at time of analysis, though the network attack vector and code execution capability make this a priority for organizations running affected Fortinet management infrastructure.
Fortinet FortiSOAR (both PaaS and on-premise versions 7.3-7.6.3) contains a path traversal vulnerability in File Content Extraction actions that allows authenticated remote attackers to read arbitrary files outside the intended directory with high confidentiality impact. The vulnerability requires valid credentials and is exploitable over the network with no user interaction; CVSS 6.5 reflects medium-to-high severity for a cloud security platform handling sensitive workflows.
Reflected cross-site scripting (XSS) in Fortinet FortiSandbox and FortiSandbox PaaS versions 5.0.0 through 5.0.4 allows unauthenticated remote attackers to inject malicious scripts via crafted HTTP requests. Exploitation requires user interaction (clicking a malicious link), resulting in session hijacking, credential theft, or malware distribution to administrators accessing the FortiSandbox web interface. No public exploit code or active exploitation has been confirmed at time of analysis.
Hard-coded cryptographic keys in Fortinet FortiClientEMS 7.4.0 through 7.4.5 allow local authenticated attackers with high privileges to disclose sensitive information and potentially modify system configurations. An attacker with administrative access can extract or leverage these embedded keys to compromise confidentiality and integrity of protected data. This vulnerability requires local access and elevated privileges, limiting but not eliminating real-world risk in multi-user or compromised endpoint scenarios.
Denial of service in Fortinet FortiWeb 7.0-8.0.3 via integer overflow allows authenticated remote attackers with high privileges to crash the application, resulting in service unavailability. The vulnerability has a CVSS score of 4.9 (Medium) and affects multiple FortiWeb versions across a wide range. No public exploit code or active exploitation has been confirmed at the time of analysis.
An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.8, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions, FortiNDR. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Stored cross-site scripting (XSS) in Fortinet FortiSandbox and FortiSandbox PaaS versions 4.2 through 5.0.5 allows authenticated administrators with high privileges to inject malicious scripts into web pages, leading to unauthorized code execution when other users interact with compromised content. The vulnerability requires user interaction (UI:R) and affects confidentiality and integrity but not availability. With a CVSS score of 4.8 and high privilege requirement (PR:H), this represents a moderate risk primarily to multi-user deployments where administrative accounts may be compromised or untrusted.
Local privilege escalation in Fortinet FortiWeb 7.0.10-8.0.2 allows high-privileged local attackers to execute arbitrary code or commands through relative path traversal, exploiting improper file path validation with CVSS 6.7 (high confidentiality, integrity, and availability impact). No public exploit code or active exploitation confirmed at time of analysis.
Path traversal vulnerability in Fortinet FortiSandbox allows privileged super-admin users with CLI access to delete arbitrary directories on the system via crafted HTTP requests. Affects FortiSandbox 5.0.0-5.0.5, 4.4.0-4.4.8, 4.2 all versions, FortiSandbox Cloud 5.0.4, and FortiSandbox PaaS 5.0.4. CVSS 6.7 reflects high integrity and availability impact but requires authenticated super-admin privileges; no public exploit code or active KEV designation identified at time of analysis.
Server-side request forgery in Fortinet FortiSOAR (both PaaS and on-premise versions 7.3 through 7.6.4) allows authenticated attackers to discover services running on local ports by crafting malicious requests. The vulnerability requires valid user credentials and carries a CVSS score of 4.3 with low confidentiality impact; no public exploit code or active exploitation has been confirmed at this time.
Fortinet FortiSOAR (both PaaS and on-premise versions 7.3-7.6.x) transmits sensitive authentication credentials in cleartext in API responses for Secure Message Exchange and RADIUS configurations, allowing authenticated attackers with network access to intercept and view passwords. The vulnerability requires user interaction (UI:R) and prior authentication (PR:L), affecting confidentiality of stored credentials in these integrations with a CVSS score of 5.7.
Fortinet FortiSOAR stores LDAP service account passwords in a recoverable format, allowing authenticated high-privilege remote attackers to retrieve plaintext or weakly protected credentials by modifying the LDAP server address in configuration. This affects FortiSOAR PaaS and on-premise versions 7.3 through 7.6.4. The vulnerability requires high-level administrative authentication and poses a confidentiality risk to stored credentials, with no evidence of active exploitation or public exploit code at time of analysis.
Stored cross-site scripting (XSS) in Fortinet FortiSOAR allows authenticated remote attackers to inject malicious scripts via crafted HTTP requests, affecting both PaaS and on-premise deployments across versions 7.3 through 7.6.3. The vulnerability requires user interaction to trigger the payload and results in limited confidentiality and integrity impact, with a CVSS score of 4.6 reflecting the authentication requirement and user-interaction dependency. No public exploit code or active exploitation has been confirmed at the time of analysis.
Unauthorized code or command execution can be triggered on unpatched Fortinet FortiOS appliances by an unauthenticated attacker who already holds an adjacent-network position and sends specially crafted packets to a critical function that lacks an authentication check. Affected branches include FortiOS 7.6.0 through 7.6.3, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11, 7.0.0 through 7.0.17, all 6.4 versions, and 6.2.9 through 6.2.17; no public exploit has been identified at time of analysis, EPSS is very low at 0.01 percent, and SSVC records Exploitation none and Automatable no. The CVSS 8.8 base score reflects high confidentiality, integrity, and availability impact once adjacency is achieved, but the AV:A precondition and lack of observed exploitation keep immediate internet-facing risk below the headline score.
Fortinet FortiSOAR PaaS and on-premise versions 7.3 through 7.6.4 store connector passwords in a recoverable format, allowing authenticated remote attackers to retrieve plaintext or weakly encrypted credentials for multiple installed connectors by modifying the server address in connector configuration. This affects security orchestration workflows that depend on connector authentication for external integrations.
Insufficiently protected credentials in Fortinet FortiSandbox 5.0.0-5.0.5, 4.4.x, and FortiSandbox PaaS 5.0.1-5.0.5 allow authenticated administrators to read LDAP server credentials via client-side inspection. This low-severity information disclosure requires high-privilege authentication and network access, exposing only credential confidentiality without enabling modification or denial of service.
SQL injection in Fortinet FortiClientEMS 7.0 through 7.4.5 allows high-privileged local attackers to execute unauthorized code or commands with high integrity and confidentiality impact. The vulnerability requires local access and high privileges (PR:H per CVSS vector), making it a risk primarily in environments where administrative users are untrusted or compromised. CISA SSVC framework rates this as non-exploitable via automation due to privilege requirements, though the technical impact is total (confidentiality, integrity, and availability compromise). No public exploit code has been identified at the time of analysis.
Remote code execution in Fortinet FortiWeb versions 7.0 through 8.0.3 stems from a stack-based buffer overflow that authenticated attackers can exploit by sending crafted HTTP requests, provided they can bypass stack protection and ASLR mechanisms. Successful exploitation allows attackers to execute arbitrary code with the privileges of the vulnerable application. No patch is currently available for this medium-severity vulnerability affecting multiple FortiWeb releases.
FortiSIEM 7.3.0-7.3.4 and 7.4.0 are vulnerable to reflected cross-site scripting that allows unauthenticated remote attackers to inject malicious scripts through URL parameters, enabling social engineering attacks against users who click malicious links. The vulnerability requires user interaction to trigger but has no authentication requirements, making it practical for phishing campaigns that redirect victims to spoofed pages.
Fortinet FortiDeceptor versions 4.0 through 6.2.0 are vulnerable to argument injection that allows authenticated super-admin users with CLI access to delete sensitive files through crafted HTTP requests. The vulnerability requires high-level privileges and direct CLI access to exploit, limiting the attack surface to trusted administrators. No patch is currently available for this issue.
A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow an authenticated attacker to crash the HTTP daemon via crafted HTTP requests. [CVSS 2.7 LOW]
Arbitrary code execution in Fortinet FortiWeb 7.0.2 through 8.0.2 stems from a stack-based buffer overflow triggered by crafted HTTP requests from authenticated attackers who can bypass stack protection mechanisms. The vulnerability affects multiple FortiWeb versions and requires high privileges and specific conditions to exploit, though no patch is currently available. An authenticated attacker with sufficient privileges could leverage this flaw to execute arbitrary commands on affected systems.
An improper restriction of excessive authentication attempts vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4 all versions, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all versions, FortiAnalyzer Cloud 7.6.0 through 7.6.4, FortiAnalyzer Cloud 7.4 all versions, FortiAnalyzer Cloud 7.2 all versions, FortiAnalyzer Cloud 7.0 all versions, FortiAnalyzer Cloud 6.4 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4 all...
Fortinet FortiSwitchAXFixed versions 1.0.0 through 1.0.1 contain an access control flaw that allows authenticated administrators to execute arbitrary system commands by uploading a malicious SSH configuration file. The vulnerability requires local access and valid admin credentials but poses a risk to organizations where admin accounts may be compromised or where insider threats are a concern. No patch is currently available.
A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer Cloud 7.6.0 through 7.6.4, FortiAnalyzer Cloud 7.4.0 through 7.4.7, FortiAnalyzer Cloud 7.2 all versions, FortiAnalyzer Cloud 7.0 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.7, FortiManager 7.2 all versions, FortiManager 7.0 all versions, Fort...
A improper certificate validation vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.8, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.8, FortiManager 7.2 all versions, FortiManager 7.0 all versions, FortiManager 6.4 all versions may allow a remote unauthenticated attacker to view confidential information via a man in the middle [MiTM] attack. [CVSS 6.9 MEDIUM]
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.11, FortiWeb 7.2.0 through 7.2.12, FortiWeb 7.0.0 through 7.0.12 may allow an authenticated attacked to execute arbitrary commands via a specialy crafted HTTP request. [CVSS 7.2 HIGH]
A cleartext storage of sensitive information vulnerability [CWE-312] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0 through 7.4.4, FortiMail 7.2.0 through 7.2.7, FortiMail 7.0.0 through 7.0.8, FortiRecorder 7.2.0 through 7.2.3, FortiRecorder 7.0 all versions, FortiRecorder 6.4 all versions, FortiVoice 7.2.0, FortiVoice 7.0.0 through 7.0.6 may allow an authenticated malicious administrator to obtain user's secrets via CLI commands. Practical exploitability is limited ...
A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiManager 7.4.0 through 7.4.2, FortiManager 7.2.0 through 7.2.10, FortiManager 6.4 all versions may allow a remote unauthenticated attacker to execute unauthorized commands via crafted requests, if the service is enabled. [CVSS 8.1 HIGH]
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] vulnerability in Fortinet FortiSOAR Agent Communication Bridge 1.1.0, FortiSOAR Agent Communication Bridge 1.0 all versions may allow an unauthenticated attacker to read files accessible to the fortisoar user on a system where the agent is deployed, via sending a crafted request to the agent port. [CVSS 5.8 MEDIUM]
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an authenticated privileged attacker to execute code via crafted requests. [CVSS 4.8 MEDIUM]
An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all versions, FortiAnalyzer-BigData 7.6.0, FortiAnalyzer-BigData 7.4.0 through 7.4.4, FortiAnalyzer-BigData 7.2 all versions, FortiAnalyzer-BigData 7.0 all versions, FortiAnalyzer-BigData 6.4 all versions, FortiAnalyzer-BigData 6.2 all versions may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted requests. [CVSS 6.0 MEDIUM]
An authentication bypass by spoofing vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.8, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow a remote unauthenticated attacker to bypass hostname restrictions via a specially crafted request. [CVSS 5.3 MEDIUM]
A hidden functionality vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.3, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2.0 through 7.2.10, FortiAnalyzer 7.0.0 through 7.0.14, FortiAnalyzer 6.4 all versions, FortiAnalyzer Cloud 7.6.2, FortiAnalyzer Cloud 7.4.1 through 7.4.7, FortiAnalyzer Cloud 7.2.1 through 7.2.10, FortiAnalyzer Cloud 7.0.1 through 7.0.14, FortiAnalyzer Cloud 6.4 all versions, FortiManager 7.6.0 through 7.6.3, FortiManager 7.4.0 through 7.4.7, FortiManager 7.2.0 through 7.2.10, FortiManager 7.0.0 through 7.0.14, FortiManager 6.4 all versions, FortiManager Cloud 7.6.2 through 7.6.3, FortiManager Cloud 7.4.1 through 7.4.7, FortiManager Cloud 7.2.1 through 7.2.10, FortiManager Cloud 7.0.1 through 7.0.14, FortiManager Cloud 6.4 all versions may allow a remote authenticated read-only admin with CLI access to escalate their privilege via use of a hidden command. [CVSS 6.7 MEDIUM]
A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0 all versions allows an authenticated admin to execute unauthorized code or commands via specifically crafted configuration. [CVSS 6.7 MEDIUM]
Forticlient versions up to 7.4.4 is affected by improper link resolution before file access (CVSS 7.1).
vulnerability in Fortinet FortiOS 7.6.0 versions up to 7.6.4 contains a vulnerability that allows attackers to an authenticated user with knowledge of FSSO policy configurations to gain unaut (CVSS 4.2).
An inconsistent interpretation of http requests ('http request smuggling') vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4.3 through 6.4.16 may allow an unauthenticated attacker to smuggle an unlogged http request through the firewall policies via a specially crafted header [CVSS 5.8 MEDIUM]
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an unauthenticated attacker to execute commands via crafted requests. [CVSS 8.8 HIGH]
Fortinet FortiOS versions up to 7.6.6 contains a vulnerability that allows attackers to decrypt LDAP credentials stored in device configuration files, as exploited in t (CVSS 3.2).
A Server-Side Request Forgery (SSRF) vulnerability [CWE-918] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.4, FortiSandbox 4.4 all versions, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an authenticated attacker to proxy internal requests limited to plaintext endpoints only via crafted HTTP requests. [CVSS 3.8 LOW]
Fortinet FortiSIEM (6.7.0 through 7.4.0) has OS command injection via crafted TCP requests. As a SIEM, compromise gives attackers access to all security logs and the ability to suppress alerts. PoC available.
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.4, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2.0 through 7.2.10, FortiClientEMS 7.0 all versions may allow an authenticated attacker with at least read-only admin permission to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests. [CVSS 7.2 HIGH]
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 through 7.0.7 allows a privileged attacker to delete files from the underlying filesystem via crafted HTTP or HTTPs requests. [CVSS 6.5 MEDIUM]
Fortinet FortiFone 7.0.0-7.0.1 and 3.0.13-3.0.23 allows unauthenticated attackers to download the complete device configuration via crafted HTTP/HTTPS requests. Configuration files contain credentials and network settings.
FortiWeb appliances running versions 8.0.0-8.0.1, 7.6.0-7.6.5, 7.4.0-7.4.10, 7.2.0-7.2.11, or 7.0.0-7.0.11 accept a stored password hash as a direct authentication credential, enabling an attacker who has obtained a valid hash out-of-band (e.g., from a leaked configuration or backup) to authenticate as that user via crafted HTTP/HTTPS requests without knowing the cleartext password. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (base 7.5 HIGH) indicates a network-reachable, low-complexity, unauthenticated flaw with high integrity impact; the primary hurdle is acquiring the hash, and the primary exposure is a network-reachable FortiWeb management interface. No public exploit identified at time of analysis.
Unauthenticated remote attackers who already know a target FortiWeb appliance's serial number can forge a cookie that the device accepts without integrity checking, allowing arbitrary operations through a single crafted HTTP or HTTPS request. Affected releases are FortiWeb 8.0.0 through 8.0.1, 7.6.0 through 7.6.5, 7.4.0 through 7.4.10, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.11; no public exploit code has been identified and the flaw is not listed in CISA KEV at time of analysis. CVSS 3.1 scores this 8.1 with AC:H solely because of the serial-number prerequisite, which narrows opportunistic mass exploitation but does not protect a targeted attacker who can obtain or enumerate the serial, so this remains a real priority despite that mitigating access-complexity factor.
Authenticated attackers with administrative privileges can exploit a SQL injection flaw in Fortinet FortiVoice to execute unauthorized code or commands, per Fortinet PSIRT advisory FG-IR-25-362. Affected versions include FortiVoice 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, and all 6.4 and 6.0 releases. The CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects network reachability with low complexity but requires high privileges, limiting realistic risk to insider abuse or post-compromise escalation; no public exploit identified at time of analysis.
OS command injection in Fortinet FortiExtender firmware lets an attacker who already holds a high-privilege administrative session run arbitrary operating-system commands on the device by sending a crafted HTTP request to the management interface. All builds of 7.0.x and 7.2.x are affected along with 7.4.0 through 7.4.7 and 7.6.0 through 7.6.3, and successful exploitation yields full compromise of confidentiality, integrity, and availability (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Exploitation is gated behind admin authentication, so only administrators or attackers who have already stolen admin credentials/sessions can trigger it; no public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is 1.71% (77th percentile).
Insufficient session expiration in Fortinet FortiOS SSLVPN allows an attacker who already holds an active SSLVPN session to retain access to network resources after the associated user account's password is changed, because FortiOS does not terminate the pre-existing session at the moment of the password change. Affected builds are FortiOS 7.4.0 and all releases of 7.2, 7.0, and 6.4, in deployments where the SSLVPN feature is enabled; units without SSLVPN are not exposed. The issue is rated CVSS 5.6 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) with an EPSS of 0.30% (21st percentile); no public exploit was identified at time of analysis, and there is no CISA KEV entry. The practical risk is moderate and context-dependent rather than a top-tier priority, because the triggering password change is a victim or administrator action the attacker cannot force (reflected in AC:H) and the behavior manifests only under particular conditions outside the attacker's control.
Arbitrary file write via path traversal in the FortiVoice web management interface (FortiVoice 7.0.0 through 7.0.7 and 7.2.0 through 7.2.2) lets a privileged authenticated operator escape the intended directory and drop files anywhere on the appliance using crafted HTTP/HTTPS commands, which on an appliance realistically escalates to remote code execution and full device compromise. NVD rates the flaw 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), while independent review revises the privilege prerequisite to PR:H because the description explicitly describes a privileged attacker holding a valid management session. There is no evidence of active exploitation (the CVE is not in CISA KEV) and no public exploit code was identified at time of analysis; the dominant limiting factor is the requirement for authenticated, privileged access to the FortiVoice administrative interface.
Authenticated read-only administrators of Fortinet FortiAuthenticator can retrieve the messaging-service credentials of other administrators through crafted requests to the administrative interface. Affected builds are FortiAuthenticator 6.6.0 through 6.6.6 and all versions of 6.5, 6.4, and 6.3. Exploitation requires an existing admin account at read-only level, keeping overall risk low (CVSS 2.7, EPSS 0.21%); no public exploit identified at time of analysis.
Information disclosure in Fortinet FortiSOAR (PaaS and on-premise) 7.3, 7.4, 7.5.0-7.5.1, and 7.6.0-7.6.2 allows an authenticated attacker with a valid low-privileged account to read data they are not authorized to access by sending crafted requests to endpoints that fail to enforce proper access controls. Impact is limited to confidentiality (C:H) with no integrity or availability effect, and a valid account is mandatory (CVSS vector PR:L), so fully anonymous external attackers cannot exploit it. No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS is low (0.26%, 17th percentile), consistent with a moderate-severity, authenticated-only issue (CVSS 6.5).
FortiSOAR 7.3 through 7.6.2 (both PaaS and on-premise) permits an attacker who already has authenticated access to a victim's user account - via a valid session or stolen credentials - to change that account's password without supplying the current password (CWE-620), leading to account takeover or lockout of the legitimate user. This is a post-authentication flaw (CVSS PR:L) with no confidentiality impact (C:N) but high integrity and availability impact (I:H, A:H); the vendor scored attack complexity as high (AC:H) while our independent assessment rates it low (AC:L). No public exploit code or CISA KEV activity is known, and EPSS is low at 0.23% (13th percentile).
Authentication bypass in Fortinet FortiWeb 8.0.0, 7.6.0-7.6.4, and 7.4.0-7.4.9 allows unauthenticated remote attackers to circumvent FortiCloud SSO login by sending a crafted SAML response message. The flaw stems from improper cryptographic signature verification (CWE-347), enabling forgery of authentication assertions. No public exploit identified at time of analysis, EPSS sits at 0.26% (50th percentile), and the issue is not currently listed in CISA KEV, though Fortinet products have historically been high-value targets.
Fortinet FortiAuthenticator 6.6.0 through 6.6.6, and all 6.5, 6.4, and 6.3 releases, allow an authenticated attacker holding at least the limited sponsor permission to read and download device logs by directly requesting specific endpoints that fail to enforce authorization (CWE-425, forced browsing). Impact is confined to confidentiality of device logs - there is no write capability and no availability impact - and the privilege gate plus the need to know the exact reachable endpoints keep realistic risk low. There is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis; EPSS is 0.23% (13th percentile), reinforcing the low-priority rating.
Authenticated low-privileged users can reboot shared FortiGate devices via crafted HTTP requests in FortiPortal 7.4.0 through 7.4.5 due to an incorrect authorization check (CWE-863). This availability-only flaw (CVSS 6.5) requires a valid portal session and a multi-tenant deployment where FortiGates are shared, limiting real-world exposure. No public exploit code or active exploitation has been identified at time of analysis, and EPSS is low at 0.31%.
Reflected cross-site scripting in Fortinet FortiSandbox (5.0.0 through 5.0.2, 4.4.0 through 4.4.7, and all versions of 4.2 and 4.0) allows an unauthenticated remote attacker to inject script into the appliance's web management interface via crafted HTTP requests. Exploitation is not automatable at scale: because the CVSS vector carries UI:R, the payload only fires if a logged-in administrator or operator is lured into opening the attacker-supplied request or link in their browser, and the resulting impact is confined to that victim's browser session (Low confidentiality and integrity, no availability impact). The flaw is rated CVSS 6.1 with an EPSS score of 6.31% (93rd percentile), indicating elevated likelihood relative to the broader CVE population, but there is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV).
OS command injection in Fortinet FortiSandbox allows an authenticated attacker with low-privilege credentials to execute arbitrary operating-system commands on the underlying appliance by sending crafted HTTP requests to the management interface, yielding full compromise of confidentiality, integrity, and availability (CVSS 8.8, CWE-78). Affected releases are FortiSandbox 5.0.0 through 5.0.2, 4.4.0 through 4.4.7, and all versions of the 4.2 and 4.0 branches, so any appliance still running those builds with reachable web management is in scope. Exploitation requires network access to the administrative interface plus valid low-privilege authentication (PR:L), meaning the risk concentrates in deployments that expose management to untrusted networks or broadly provision low-privilege accounts; no public exploit identified at time of analysis, though EPSS is elevated at 17.19% (97th percentile), signaling meaningful predicted exploitation activity.
Authenticated OS command injection in Fortinet FortiSandbox (versions 5.0.0-5.0.2, 4.4.0-4.4.7, all 4.2.x, all 4.0.x) and FortiSandbox Cloud (24.1 and all 23.x) allows a high-privileged remote attacker to execute arbitrary commands by sending crafted HTTP/HTTPS requests to the management interface. No public exploit identified at time of analysis and the issue is not currently listed in CISA KEV, but the breadth of affected major versions and the network-reachable attack surface make this a notable post-authentication risk for security appliance operators.
A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiADC 8.0.0, FortiADC 7.6.0 through 7.6.3, FortiADC 7.4 all versions, FortiADC 7.2 all. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A Cleartext Storage of Sensitive Information in Memory vulnerability [CWE-316] in Fortinet FortiPAM 1.6.0, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM. Rated medium severity (CVSS 4.2), this vulnerability is low attack complexity. No vendor patch available.
A use of hard-coded credentials vulnerability in Fortinet FortiWeb 7.6.0, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow an authenticated attacker with. Rated medium severity (CVSS 5.3), this vulnerability is low attack complexity. No vendor patch available.
An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 through 7.0.7. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS. Rated high severity (CVSS 7.5), this vulnerability is no authentication required. No vendor patch available.
An improper neutralization of crlf sequences ('crlf injection') vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 through 7.4.5, FortiMail 7.2 all versions, FortiMail 7.0 all. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiADC 7.4.0, FortiADC 7.2 all versions, FortiADC 7.1 all versions, FortiADC 7.0 all versions, FortiADC 6.2. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS. Rated low severity (CVSS 1.9). No vendor patch available.
An active debug code vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through 7.2.10, FortiClientWindows 7.0 all versions may allow a local attacker to run. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.
An Out-of-bounds Write vulnerability [CWE-787] in FortiADC 8.0.0, 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, 7.2 all versions, 7.1 all versions, 7.0 all versions, 6.2 all versions may allow an. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. No vendor patch available.
An Exposed IOCTL with Insufficient Access Control vulnerability [CWE-782] vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through 7.2.9 may allow an. Rated high severity (CVSS 7.8). No vendor patch available.
Authenticated local CLI users on affected FortiExtender firmware can trigger a classic buffer overflow by supplying crafted CLI commands, potentially executing arbitrary code or commands with high confidentiality, integrity, and availability impact. The issue affects FortiExtender 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, and all 7.2 and 7.0 versions; exploitation requires valid CLI credentials and local/management-plane access, and no public exploit was identified at time of analysis (EPSS 0.03%, 7th percentile).
A debug messages revealing unnecessary information vulnerability in Fortinet FortiExtender 7.6.0 through 7.6.1, FortiExtender 7.4.0 through 7.4.6, FortiExtender 7.2 all versions, FortiExtender 7.0. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
A Heap-based Buffer Overflow vulnerability [CWE-122] vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through 7.2.8 may allow an authenticated local IPSec. Rated high severity (CVSS 7.8). No vendor patch available.
An Improper Isolation or Compartmentalization vulnerability [CWE-653] in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Local privilege escalation in Fortinet's FortiDLP Agent for macOS lets an authenticated local attacker escalate to root by sending a crafted request to a local listening port exposed by the Outlookproxy plugin. The flaw is a path traversal (CWE-22) in which the plugin mishandles a pathname, allowing the attacker to reach files or operations outside the intended restricted directory under the agent's privileged context. The affected versions are 11.5.1, 11.4.2 through 11.4.6, 11.3.2 through 11.3.4, 11.2.0 through 11.2.3, 11.1.1 through 11.1.2, 11.0.1, 10.5.1, 10.4.0, and 10.3.1, on macOS endpoints only, and exploitation requires an existing local foothold (CVSS PR:L, AV:L, no user interaction). Per available intelligence there is no public exploit code, the vulnerability is not in CISA KEV, and EPSS is low at 0.21 percent (11th percentile), making this a credible but second-tier priority rather than an emergency.
Local privilege escalation in Fortinet's FortiDLP Agent on Windows (Outlookproxy plugin) allows an authenticated, low-privileged local user to elevate to the LocalService account by sending a crafted path-traversal request to the agent's local listening port. Affected builds include 11.5.1, 11.4.2 through 11.4.6, 11.3.2 through 11.3.4, 11.2.0 through 11.2.3, 11.1.1 through 11.1.2, 11.0.1, 10.5.1, 10.4.0 and 10.3.1, with CVSS 3.1 base 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the EPSS probability is low at roughly 0.21% (10th percentile), so this is a credible but not emergency-grade local escalation issue that requires an attacker to already hold a foothold on the host.
Local disclosure of a signed-in user's email information through the Outlookproxy plugin in Fortinet FortiDLP Agent on macOS and Windows, reachable only by an attacker who is already an authenticated administrator on the endpoint (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N, base 6.0, CWE-359). Affected releases are 11.5.1, 11.4.2 through 11.4.6, 11.3.2 through 11.3.4, 11.2.0 through 11.2.3, 11.1.1 through 11.1.2, 11.0.1, 10.5.1, 10.4.0 and 10.3.1. Because the vector requires local access and high privileges, the realistic threat is insider misuse or post-compromise lateral activity on a managed host rather than remote attack; no public exploit identified at time of analysis, no KEV listing, and EPSS is 0.18% (7th percentile).
Information disclosure in FortiDLP Agent 12.0.0 through 12.0.5, 11.5.1, 11.4.6, and 11.4.5 allows local users with low privileges to read enrollment codes improperly written to log files and reuse them, causing limited confidentiality and integrity impact. Exploitation requires local access and readable logs; no public exploit identified at time of analysis, and EPSS is low at 0.16% (4th percentile). Fortinet advisory FG-IR-25-160 is available, and this is a low-to-moderate priority issue despite being a Fortinet product.
Sensitive data exposure in Fortinet FortiADC lets an authenticated attacker with low privileges (PR:L) pull confidential information off the appliance by sending crafted HTTP or HTTPS requests to its web/management interface. Affected releases are 7.4.0, 7.2.3 and below, 7.1.4 and below, and all 7.0 and 6.2 versions; the flaw is not reachable by a fully unauthenticated actor, since a valid low-privilege session and network access to the interface are prerequisites. Impact is confidentiality-only (C:H/I:N/A:N) with no integrity or availability effect, no publicly available exploit code has been identified at time of analysis, and EPSS is low at 0.30% (21st percentile), making this a moderate-priority information-disclosure issue rather than an urgent one.
Authenticated denial-of-service in Fortinet FortiOS allows a high-privileged user to crash the HTTP daemon via a specially crafted API request. The root cause is an unchecked return value (CWE-252) that triggers a null pointer dereference in the HTTP daemon, resulting in a temporary service disruption. EPSS exploitation probability is 0.06% (20th percentile), no KEV listing, and no public exploit identified at time of analysis, placing this as low operational priority despite network-reachable attack vector.
System command execution on FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2.5 through 7.2.10, 7.0.0 through 7.0.15 and all 6.4 branches allows an authenticated attacker who already holds a high-privilege CLI session to escape the intended CLI restriction and run commands on the underlying operating system by issuing crafted commands (CWE-684). Because the vector is local (AV:L) with PR:H, this is not reachable by unauthenticated remote attackers and does not affect default remote-facing configurations. EPSS is 0.29% (19th percentile) and no public exploit identified at time of analysis; realistic risk is confined to environments where lower-trust or additional users are granted administrative CLI access, or where a privileged account is compromised.
Stored cross-site scripting (XSS) in FortiSIEM allows an attacker who already holds high (administrative-level) privileges on the platform to persist a crafted script into web-generated pages, which then executes in the browser of another authenticated user who loads the affected page. The flaw affects FortiSIEM 7.2.0 through 7.2.2 and all versions of 7.1, 7.0, 6.7, 6.6, 6.5, 6.4, 6.3 and 6.2, and is rated CVSS 4.8 with EPSS probability of 0.27% (18th percentile); per available intelligence there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV. Because exploitation demands prior admin-level access (PR:H) plus victim interaction (UI:R), this is a genuinely low-priority issue despite carrying a network attack vector - it is primarily relevant as an insider or post-compromise escalation and persistence primitive rather than a remotely exploitable unauthenticated attack.
Authenticated heap-based buffer overflow in FortiOS, FortiPAM, and FortiProxy RDP bookmark handling can allow a low-privileged user to execute unauthorized code. Affected deployments include FortiOS 7.6.2 and below, 7.4.7 and below, 7.2.10 and below, and all 7.0/6.4 branches; FortiPAM through 1.5.0; and FortiProxy 7.6.2/7.4.3 and below and all 7.2/7.0 branches. No public exploit identified at time of analysis, and EPSS is low at 0.08%, though CVSS 8.8 reflects high confidentiality, integrity, and availability impact once an attacker holds valid low-privilege credentials and can reach the RDP bookmark feature.
A local low-privileged Windows user can achieve DLL hijacking in the FortiClient Online Installer because the installer loads DLLs from a search path the user can write to, allowing a planted malicious DLL to run when the installer is executed. Affected builds are FortiClient Windows 7.4.0 through 7.4.3, 7.2.0 through 7.2.11, and all 7.0 releases when delivered via the Online Installer; per the CVSS vector the attack requires a local account (PR:L) and some form of user or deployment action to launch the installer (UI:R). Risk is tempered by a very low EPSS score of 0.18% (7th percentile), and no public exploit code has been identified and there is no CISA KEV entry indicating active exploitation; the assessor rates this as high-scored (7.3) but comparatively low-urgency because exploitation presupposes an existing local foothold and write access to the installer folder.
An unauthenticated race condition (CWE-362) in Fortinet FortiAnalyzer's FortiCloud SSO authorization logic lets a remote attacker attempt to win a timing-sensitive race and bypass SSO authorization by sending crafted, concurrent FortiCloud SSO requests. Affected builds are 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, and all versions before 7.0.13, and the flaw only matters where FortiCloud SSO is actually configured - deployments using purely local authentication are out of scope. Rated CVSS 5.3 (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N) with EPSS around 0.32% (22nd percentile), this is a moderate-severity, lower-priority issue rather than a top-tier emergency, and there is no public exploit identified at time of analysis.
Improper authorization in Fortinet FortiOS and FortiProxy lets an authenticated, low-privileged attacker read static files belonging to other VDOMs through crafted HTTP or HTTPS requests, but only when the device is configured in multi-VDOM mode and the management interface is reachable. Impact is limited to confidentiality of static files; integrity and availability are unaffected. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is 0.32% (23rd percentile), so this is a low-to-moderate priority issue.