11
CVEs
2
Critical
3
High
0
KEV
1
PoC
4
Unpatched C/H
9.1%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
3
MEDIUM
4
LOW
2
Monthly CVE Trend
Affected Products (30)
Fortios
172
Fortiweb
87
Fortimanager
82
Fortiproxy
75
Fortianalyzer
66
Forticlient
53
Fortisandbox
37
Fortimail
35
Fortiportal
32
Fortiadc
27
Fortisiem
22
Fortipam
22
Fortimanager Cloud
22
Fortiwlm
19
Fortisoar
18
Fortinet Antivirus
17
Fortivoice
16
Fortiauthenticator
16
Fortitester
14
Fortinac
14
Fortimanager Firmware
14
Panda Antivirus
13
Rising Antivirus
12
Fortianalyzer Cloud
11
Esafe
11
Forticlientems
11
Fortiswitchmanager
11
Fortianalyzer Firmware
11
Fortiwlc
11
Open Redirect
10
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-55841 | Log-record tampering in Graylog's FortiGate syslog parser enables unauthenticated network senders to overwrite or erase critical security-log fields - including srcip, dstip, date, time, and tz - or cause entire log messages to be silently discarded, creating a viable log-evasion primitive. Affected are Graylog Server versions prior to 6.3.12, 7.0.7, and 7.1.2 (all branches), and Graylog Forwarder prior to version 7.3, on any deployment ingesting FortiGate key-value syslog. No public exploit code exists and this is not in CISA KEV, but the attack requires no authentication and minimal crafting skill, making it a realistic threat to security-monitoring integrity in FortiGate-centric environments. | HIGH | 7.5 | 0.4% | 58 |
PoC
|
| CVE-2026-26084 | Unauthenticated remote access control bypass in Fortinet FortiSandbox 4.2.x through 5.0.x - and its Cloud and PaaS variants - allows network-reachable attackers to retrieve sensitive information and disrupt availability by sending crafted HTTP requests, with no credentials or user interaction required. Fortinet's confirmed CVSS temporal metrics include E:P (proof-of-concept exploit code exists) alongside RL:O (official remediation available) and RC:C (confirmed), establishing this as an actively documented, patchable risk against sandboxing infrastructure that processes enterprise malware submissions. The scope-changed vector (S:C) combined with high availability impact (A:H) indicates the access control failure cascades beyond the directly targeted HTTP endpoint to other components within the FortiSandbox platform. | CRITICAL | 9.9 | 0.2% | 55 |
No patch
|
| CVE-2026-84390 | Sensitive information embedded in the source code of Fortinet FortiMonitorOnSight (7.2.0-7.2.2 and 7.2.4-7.2.7) can be recovered by an attacker and leveraged to bypass access controls. The exposed data (CWE-540) may include credentials, keys, or other secrets that grant unauthorized access to protected functionality. No public exploit is identified at time of analysis, and the CVE's own attack-vector text is an unfilled placeholder, so the exact delivery path is not documented by the vendor. | CRITICAL | 9.8 | 0.5% | 49 |
No patch
|
| CVE-2026-84393 | Improper certificate hostname validation (CWE-297) in Fortinet FortiOS and FortiProxy enables network-adjacent attackers to conduct man-in-the-middle attacks against outbound TLS connections made by affected devices. Fortinet FortiOS versions 7.6.1 through 7.6.6 and FortiProxy 7.6.2 through 7.6.6 fail to verify that a presented certificate matches the intended hostname, allowing a suitably positioned attacker to intercept and potentially tamper with encrypted traffic. Proof-of-concept code exists (E:P in temporal CVSS), and an official fix has been released per vendor advisory FG-IR-26-174. | HIGH | 8.1 | 0.2% | 41 |
No patch
|
| CVE-2026-84387 | Command injection in Fortinet FortiSandbox allows a remote, highly privileged attacker to execute arbitrary OS commands on the underlying system, achieving full confidentiality, integrity, and availability compromise. Affected versions span FortiSandbox 4.2.1-4.2.8, 4.4.0-4.4.9, 5.0.0-5.0.6, and 5.2.0, covering a wide release range across multiple major branches. The temporal CVSS metrics (E:F/RL:O/RC:C) confirm that a functional exploit exists and an official patch has been released, making prompt patching the priority action. | HIGH | 7.2 | 0.9% | 36 |
No patch
|
| CVE-2026-84391 | Denial of service in Fortinet FortiAnalyzer 7.6.3 through 7.6.6 is achievable by a low-privileged remote attacker exploiting a use of uninitialized variable (CWE-457) flaw. A confirmed proof-of-concept exists per the CVSS temporal vector (E:P), and an official remediation is available per the Fortinet PSIRT advisory FG-IR-26-172. The CVE description contains a verbatim placeholder ('<insert attack vector here>') instead of the specific triggering mechanism, reducing technical precision; however, the CVSS vector (AV:N/AC:L/PR:L) confirms network-reachable exploitation requiring only low-privilege credentials. No confirmed active exploitation (CISA KEV) has been identified at time of analysis. | MEDIUM | 6.5 | 0.2% | 32 |
No patch
|
| CVE-2026-84385 | Improper access control (CWE-284) in Fortinet FortiSOAR allows an authenticated low-privilege user to escalate their privileges within the platform via an undisclosed attack vector. Both PaaS and on-premise deployments across FortiSOAR versions 7.3 through 7.6.6 are affected. No public exploit or CISA KEV listing is present at time of analysis; the Fortinet PSIRT advisory FG-IR-26-164 is the sole authoritative source. | MEDIUM | 5.4 | 0.1% | 27 |
No patch
|
| CVE-2026-84386 | Unverified ownership checks in Fortinet FortiClientWindows allow a locally authenticated administrator to perform improper access control operations, resulting in high availability impact and minor integrity modification of the endpoint security client. Affected versions are FortiClientWindows 7.4.0 through 7.4.7 and 7.2.0 through 7.2.15 on Windows endpoints. No public exploit or active exploitation has been identified; the attack surface is substantially constrained by the local-only, high-privilege prerequisite. | MEDIUM | 5.1 | 0.1% | 26 |
No patch
|
| CVE-2026-22575 | Improper access control in Fortinet FortiManager and FortiManager Cloud allows authenticated administrators to bypass the workflow session approval process via crafted HTTP or HTTPS requests (CWE-284). Affected versions span FortiManager 6.4.x through 7.6.4 and FortiManager Cloud 6.4.x through 7.6.4 per EUVD intelligence, a broader range than the base CVE description indicates. An admin who should be subject to a change-management or four-eyes approval policy can circumvent that gate, pushing unapproved configuration changes to managed FortiGate devices. No public exploit code or CISA KEV listing is identified at time of analysis. | MEDIUM | 4.9 | 0.2% | 24 |
No patch
|
| CVE-2026-84389 | Open redirect (CWE-601) in Fortinet FortiSIEM 7.4.1-7.5.1 allows unauthenticated remote attackers to redirect FortiSIEM users to attacker-controlled sites via a crafted URL, enabling phishing or credential-harvesting attacks against security operations personnel. The CVSS temporal score includes E:P (proof of concept exists) and RL:O (official fix available), per Fortiguard advisory FG-IR-26-169. No active exploitation confirmed and no KEV listing; the overall risk is constrained by AC:H and mandatory user interaction, yielding a low base score of 2.8. | LOW | 3.1 | 0.1% | 16 |
No patch
|
| CVE-2026-84392 | Authenticated denial of service in Fortinet FortiOS, FortiPAM, and FortiProxy allows a high-privileged network attacker to crash the httpsd daemon by sending specially crafted HTTP requests, exploiting a NULL pointer dereference (CWE-476). The vulnerability spans FortiOS 7.2.x and 7.4.x, FortiProxy 7.2 through 7.6.6, and every FortiPAM release from 1.0.0 through 1.9.0. No active in-the-wild exploitation is confirmed, but the CVSS temporal metric E:P indicates proof-of-concept code exists; Fortinet has released an official fix under advisory FG-IR-26-173. | LOW | 2.7 | 0.3% | 14 |
No patch
|