72
CVEs
10
Critical
17
High
3
KEV
5
PoC
26
Unpatched C/H
1.4%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
10
HIGH
17
MEDIUM
39
LOW
6
Monthly CVE Trend
Affected Products (30)
Fortios
172
Fortiweb
87
Fortimanager
82
Fortiproxy
75
Fortianalyzer
66
Forticlient
53
Fortisandbox
37
Fortimail
35
Fortiportal
32
Fortiadc
27
Fortisiem
22
Fortipam
22
Fortimanager Cloud
22
Fortiwlm
19
Fortisoar
18
Fortinet Antivirus
17
Fortivoice
16
Fortiauthenticator
16
Fortitester
14
Fortinac
14
Fortimanager Firmware
14
Panda Antivirus
13
Rising Antivirus
12
Fortianalyzer Cloud
11
Esafe
11
Forticlientems
11
Fortiswitchmanager
11
Fortianalyzer Firmware
11
Fortiwlc
11
Open Redirect
10
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-39808 | OS command injection in Fortinet FortiSandbox 4.4.0-4.4.8 and FortiSandbox PaaS versions 21.3-23.4 enables remote unauthenticated attackers to execute arbitrary system commands with complete system compromise. CVSS 9.8 (network, low complexity, no privileges) but EPSS 0.29% (53rd percentile) suggests limited real-world exploitation observed despite maximum severity score. No active exploitation confirmed (not in CISA KEV). SSVC framework classifies as automatable with total technical impact but no known exploitation. Fortinet PSIRT advisory FG-IR-26-100 available but description incomplete (missing attack vector specifics). | CRITICAL | 9.8 | 0.3% | 124 |
KEV
PoC
No patch
|
| CVE-2026-35616 | Remote code execution in Fortinet FortiClientEMS versions 7.4.5 through 7.4.6 allows unauthenticated attackers to execute arbitrary code via crafted network requests. The vulnerability stems from improper access control (CWE-284) and requires no user interaction or privileges (CVSS PR:N). With a CVSS score of 9.1 (Critical) and low attack complexity, this represents a severe exposure for organizations using affected FortiClientEMS versions. The CVSS temporal metrics indicate functional exploit code exists (E:F) with an official fix available (RL:O), making this a high-priority patching target despite no confirmed active exploitation (not present in CISA KEV). | CRITICAL | 9.8 | 0.0% | 124 |
KEV
PoC
No patch
|
| CVE-2026-25089 | Unauthenticated OS command injection in Fortinet FortiSandbox (on-premise, Cloud, and PaaS variants) allows remote attackers to execute arbitrary operating system commands by sending specifically crafted HTTP requests to the management interface. The flaw carries a CVSS 9.8 rating with network-reachable, no-authentication, no-user-interaction characteristics, and no public exploit identified at time of analysis. Because FortiSandbox is a security-analysis appliance handling untrusted samples, compromise undermines the integrity of malware verdicts and downstream detections. | CRITICAL | 9.8 | 2.0% | 121 |
KEV
PoC
No patch
|
| CVE-2026-39813 | Path traversal in Fortinet FortiSandbox 4.4.0-4.4.8 and 5.0.0-5.0.5 enables remote unauthenticated attackers to achieve full system compromise. With CVSS 9.8 (AV:N/AC:L/PR:N/UI:N), the vulnerability permits network-based exploitation without credentials or user interaction, leading to complete confidentiality, integrity, and availability impact. Despite critical severity, EPSS score of 0.06% (18th percentile) indicates low observed exploitation probability. No active exploitation confirmed (not in CISA KEV). SSVC framework marks it as automatable with total technical impact but no current exploitation. The incomplete CVE description (placeholder text for attack vector) suggests early disclosure; verify completeness with Fortinet advisory FG-IR-26-112. | CRITICAL | 9.8 | 0.1% | 74 |
PoC
No patch
|
| CVE-2026-55841 | Log-record tampering in Graylog's FortiGate syslog parser enables unauthenticated network senders to overwrite or erase critical security-log fields - including srcip, dstip, date, time, and tz - or cause entire log messages to be silently discarded, creating a viable log-evasion primitive. Affected are Graylog Server versions prior to 6.3.12, 7.0.7, and 7.1.2 (all branches), and Graylog Forwarder prior to version 7.3, on any deployment ingesting FortiGate key-value syslog. No public exploit code exists and this is not in CISA KEV, but the attack requires no authentication and minimal crafting skill, making it a realistic threat to security-monitoring integrity in FortiGate-centric environments. | HIGH | 7.5 | 0.4% | 58 |
PoC
|
| CVE-2026-26084 | Unauthenticated remote access control bypass in Fortinet FortiSandbox 4.2.x through 5.0.x - and its Cloud and PaaS variants - allows network-reachable attackers to retrieve sensitive information and disrupt availability by sending crafted HTTP requests, with no credentials or user interaction required. Fortinet's confirmed CVSS temporal metrics include E:P (proof-of-concept exploit code exists) alongside RL:O (official remediation available) and RC:C (confirmed), establishing this as an actively documented, patchable risk against sandboxing infrastructure that processes enterprise malware submissions. The scope-changed vector (S:C) combined with high availability impact (A:H) indicates the access control failure cascades beyond the directly targeted HTTP endpoint to other components within the FortiSandbox platform. | CRITICAL | 9.9 | 0.2% | 55 |
No patch
|
| CVE-2026-26035 | Authentication bypass in Fortinet FortiWeb (versions 7.0.0-7.0.12, 7.2.0-7.2.12, 7.4.0-7.4.11, 7.6.0-7.6.6, and 8.0.0-8.0.2) lets a remote unauthenticated attacker log into the GUI/CLI management interface using an arbitrary, made-up username and password, granting full administrative control of the web application firewall. Tracked as CVE-2026-26035 (EUVD-2026-57193) and rated CVSS 9.8, this is an improper-authentication (CWE-287) flaw reported by Fortinet's own PSIRT (FG-IR-26-158). There is no public exploit identified at time of analysis and it is not on the CISA KEV list, but the trivial exploitability and network exposure make it a high-priority patch. | CRITICAL | 9.8 | 0.5% | 50 |
No patch
|
| CVE-2026-26083 | Remote code execution in Fortinet FortiSandbox 4.4.x through 5.0.x (on-premises, Cloud, and PaaS deployments) allows unauthenticated attackers to execute arbitrary code or commands via crafted HTTP requests. This CWE-862 missing authorization flaw affects sandbox analysis appliances across multiple deployment models with CVSS 9.8 (critical) severity. Fortinet has published vendor advisory FG-IR-26-136. No CISA KEV listing or public POC identified at time of analysis, though the trivial attack complexity (AC:L) and network vector without authentication (PR:N) indicate high exploitability if technical details emerge. | CRITICAL | 9.8 | 0.0% | 49 |
No patch
|
| CVE-2026-44277 | Critical unauthenticated access control bypass in Fortinet FortiAuthenticator versions 6.5.0-6.5.6, 6.6.0-6.6.8, 8.0.0, and 8.0.2 enables remote code execution without authentication. The CVSS score of 9.8 with AV:N/AC:L/PR:N/UI:N indicates trivial remote exploitation against default configurations. While the vendor advisory (FG-IR-26-128) confirms this vulnerability, the incomplete description placeholder ('<insert attack vector here>') suggests the advisory may contain additional details not yet published in CVE records. No public exploit code or active exploitation confirmed at time of analysis, though the authentication bypass nature and maximum CVSS scores make this a priority patching target for organizations running FortiAuthenticator. | CRITICAL | 9.8 | 0.0% | 49 |
No patch
|
| CVE-2026-84390 | Sensitive information embedded in the source code of Fortinet FortiMonitorOnSight (7.2.0-7.2.2 and 7.2.4-7.2.7) can be recovered by an attacker and leveraged to bypass access controls. The exposed data (CWE-540) may include credentials, keys, or other secrets that grant unauthorized access to protected functionality. No public exploit is identified at time of analysis, and the CVE's own attack-vector text is an unfilled placeholder, so the exact delivery path is not documented by the vendor. | CRITICAL | 9.8 | 0.5% | 49 |
No patch
|
| CVE-2026-39815 | SQL injection in Fortinet FortiDDoS-F 7.2.1-7.2.2 allows authenticated remote attackers to execute unauthorized code or commands with high impact to confidentiality, integrity, and availability. The vulnerability resides in the web management interface and requires low attack complexity with no user interaction. No public exploit identified at time of analysis, with EPSS data not yet available for this recently disclosed CVE. | HIGH | 8.8 | 0.1% | 44 |
No patch
|
| CVE-2025-53844 | Remote code execution in Fortinet FortiOS 7.2.0-7.2.11, 7.4.0-7.4.8, and 7.6.0-7.6.3 enables authenticated attackers to execute arbitrary code via malformed network packets. The out-of-bounds write vulnerability (CWE-787) affects FortiOS firewall appliances and requires only low-privilege credentials to exploit over the network. Fortinet published advisory FG-IR-26-123 confirming the vulnerability. No CISA KEV listing or public exploit code identified at time of analysis, though the straightforward network attack vector (AV:N/AC:L) suggests moderate weaponization potential once details emerge. | HIGH | 8.8 | 0.0% | 44 |
No patch
|
| CVE-2026-59835 | Exposure of a scanning VM's VNC service in Fortinet FortiSandbox 5.0.0-5.0.2 and 4.4.3-4.4.8 lets an unauthenticated remote attacker reach the VNC server of the sandbox virtual machines used for malware detonation via ordinary network requests. Because these VMs run and observe live malware samples, unauthorized VNC access can expose sensitive analysis sessions and potentially allow interaction with the detonation environment. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. | HIGH | 8.6 | 0.4% | 43 |
No patch
|
| CVE-2026-59841 | Privilege escalation in Fortinet FortiSIEM Windows Agent 7.4.0 through 7.4.1 stems from an improper restriction of the agent's communication channel (CWE-923), letting an adjacent-network attacker interact with an endpoint that should be limited to trusted parties and thereby gain elevated privileges with full confidentiality, integrity, and availability impact. The flaw was disclosed by Fortinet PSIRT (FG-IR-26-155) and carries a CVSS 7.5 rating; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation is gated by high attack complexity, which materially reduces real-world likelihood despite the unauthenticated vector. | HIGH | 7.5 | 0.1% | 43 |
No patch
|
| CVE-2026-70468 | Authentication bypass in Fortinet FortiManager and FortiManager Cloud allows unauthenticated remote attackers to circumvent access controls via an alternate path or channel, potentially gaining full administrative control over managed security infrastructure. Affected version ranges span FortiManager 7.2.5 through 7.6.1 and FortiManager Cloud 7.2.5 through 7.6.1, covering multiple active release branches of this centralized network security management platform. No CISA KEV listing or confirmed public exploit has been identified at time of analysis, but the unauthenticated network vector combined with full C/I/A impact and the high-value nature of the target - a platform governing firewall policy across entire enterprise estates - elevates real-world priority significantly beyond the AC:H qualifier alone. | HIGH | 8.1 | 0.6% | 41 |
No patch
|