837
CVEs
91
Critical
275
High
20
KEV
64
PoC
335
Unpatched C/H
6.6%
Patch Rate
2.9%
Avg EPSS
Severity Breakdown
CRITICAL
91
HIGH
275
MEDIUM
420
LOW
51
Monthly CVE Trend
Affected Products (30)
Fortios
172
Fortiweb
87
Fortimanager
82
Fortiproxy
75
Fortianalyzer
66
Forticlient
53
Fortisandbox
37
Fortimail
35
Fortiportal
32
Fortiadc
27
Fortisiem
22
Fortipam
22
Fortimanager Cloud
22
Fortiwlm
19
Fortisoar
18
Fortinet Antivirus
17
Fortivoice
16
Fortiauthenticator
16
Fortitester
14
Fortinac
14
Fortimanager Firmware
14
Panda Antivirus
13
Rising Antivirus
12
Fortianalyzer Cloud
11
Esafe
11
Forticlientems
11
Fortiswitchmanager
11
Fortianalyzer Firmware
11
Fortiwlc
11
Open Redirect
10
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2022-40684 | An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 100.0% | 234 |
KEV
PoC
No patch
|
| CVE-2025-64446 | Fortinet FortiWeb contains a relative path traversal allowing unauthenticated attackers to execute administrative commands through crafted HTTP/HTTPS requests. | CRITICAL | 9.8 | 88.2% | 222 |
KEV
PoC
No patch
|
| CVE-2024-55591 | FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote attackers to gain super-admin privileges through crafted requests. | CRITICAL | 9.8 | 94.2% | 213 |
KEV
PoC
No patch
|
| CVE-2024-21762 | A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiProxy. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 83.4% | 202 |
KEV
PoC
No patch
|
| CVE-2023-27997 | A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 85.7% | 185 |
KEV
No patch
|
| CVE-2025-58034 | Fortinet FortiWeb contains an authenticated OS command injection allowing privilege escalation to execute unauthorized commands on the web application firewall. | HIGH | 7.2 | 50.7% | 172 |
KEV
PoC
No patch
|
| CVE-2020-12812 | FortiOS SSL-VPN contains an improper authentication vulnerability that allows users to bypass two-factor authentication by changing the case of their username, undermining MFA security controls. | CRITICAL | 9.8 | 48.5% | 158 |
KEV
No patch
|
| CVE-2016-1909 | Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0.8; and FortiOS 4.1.x before 4.1.11, 4.2.x before 4.2.16, 4.3.x before 4.3.17. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 78.6%. | CRITICAL | 9.8 | 78.6% | 148 |
PoC
No patch
|
| CVE-2023-34992 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands via crafted API. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 65.5% | 135 |
PoC
No patch
|
| CVE-2016-6909 | Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9 and FortiSwitch before 3.4.3 allows remote attackers to execute arbitrary code. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 63.4%. | CRITICAL | 9.8 | 63.4% | 132 |
PoC
No patch
|
| CVE-2026-39808 | OS command injection in Fortinet FortiSandbox 4.4.0-4.4.8 and FortiSandbox PaaS versions 21.3-23.4 enables remote unauthenticated attackers to execute arbitrary system commands with complete system compromise. CVSS 9.8 (network, low complexity, no privileges) but EPSS 0.29% (53rd percentile) suggests limited real-world exploitation observed despite maximum severity score. No active exploitation confirmed (not in CISA KEV). SSVC framework classifies as automatable with total technical impact but no known exploitation. Fortinet PSIRT advisory FG-IR-26-100 available but description incomplete (missing attack vector specifics). | CRITICAL | 9.8 | 0.3% | 124 |
KEV
PoC
No patch
|
| CVE-2026-21643 | A product has a SQL injection vulnerability enabling unauthenticated database compromise through improperly neutralized SQL commands. | CRITICAL | 9.8 | 0.0% | 124 |
KEV
PoC
No patch
|
| CVE-2026-35616 | Remote code execution in Fortinet FortiClientEMS versions 7.4.5 through 7.4.6 allows unauthenticated attackers to execute arbitrary code via crafted network requests. The vulnerability stems from improper access control (CWE-284) and requires no user interaction or privileges (CVSS PR:N). With a CVSS score of 9.1 (Critical) and low attack complexity, this represents a severe exposure for organizations using affected FortiClientEMS versions. The CVSS temporal metrics indicate functional exploit code exists (E:F) with an official fix available (RL:O), making this a high-priority patching target despite no confirmed active exploitation (not present in CISA KEV). | CRITICAL | 9.8 | 0.0% | 124 |
KEV
PoC
No patch
|
| CVE-2026-25089 | Unauthenticated OS command injection in Fortinet FortiSandbox (on-premise, Cloud, and PaaS variants) allows remote attackers to execute arbitrary operating system commands by sending specifically crafted HTTP requests to the management interface. The flaw carries a CVSS 9.8 rating with network-reachable, no-authentication, no-user-interaction characteristics, and no public exploit identified at time of analysis. Because FortiSandbox is a security-analysis appliance handling untrusted samples, compromise undermines the integrity of malware verdicts and downstream detections. | CRITICAL | 9.8 | 2.0% | 121 |
KEV
PoC
No patch
|
| CVE-2025-25249 | Remote code execution in Fortinet FortiOS (6.4 through 7.6.3) and FortiSwitchManager (7.0.x/7.2.x) lets an attacker run unauthorized code or commands by sending specially crafted packets to an affected device. The flaw is a heap-based buffer overflow requiring no authentication or user interaction, and it is confirmed actively exploited (CISA KEV) with publicly available exploit code, reportedly tied to a 'PivotC2' FortiGate RAT. Despite the KEV listing, EPSS is only 0.01% (2nd percentile), indicating targeted rather than mass-scanning exploitation to date. | CRITICAL | 9.8 | 0.0% | 119 |
KEV
PoC
No patch
|