140
CVEs
18
Critical
39
High
10
KEV
12
PoC
56
Unpatched C/H
0.7%
Patch Rate
1.2%
Avg EPSS
Severity Breakdown
CRITICAL
18
HIGH
39
MEDIUM
71
LOW
12
Monthly CVE Trend
Affected Products (30)
Fortios
172
Fortiweb
87
Fortimanager
82
Fortiproxy
75
Fortianalyzer
66
Forticlient
53
Fortisandbox
37
Fortimail
35
Fortiportal
32
Fortiadc
27
Fortisiem
22
Fortipam
22
Fortimanager Cloud
22
Fortiwlm
19
Fortisoar
18
Fortinet Antivirus
17
Fortivoice
16
Fortiauthenticator
16
Fortitester
14
Fortinac
14
Fortimanager Firmware
14
Panda Antivirus
13
Rising Antivirus
12
Fortianalyzer Cloud
11
Esafe
11
Forticlientems
11
Fortiswitchmanager
11
Fortianalyzer Firmware
11
Fortiwlc
11
Open Redirect
10
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-64446 | Fortinet FortiWeb contains a relative path traversal allowing unauthenticated attackers to execute administrative commands through crafted HTTP/HTTPS requests. | CRITICAL | 9.8 | 88.2% | 222 |
KEV
PoC
No patch
|
| CVE-2025-58034 | Fortinet FortiWeb contains an authenticated OS command injection allowing privilege escalation to execute unauthorized commands on the web application firewall. | HIGH | 7.2 | 50.7% | 172 |
KEV
PoC
No patch
|
| CVE-2026-39808 | OS command injection in Fortinet FortiSandbox 4.4.0-4.4.8 and FortiSandbox PaaS versions 21.3-23.4 enables remote unauthenticated attackers to execute arbitrary system commands with complete system compromise. CVSS 9.8 (network, low complexity, no privileges) but EPSS 0.29% (53rd percentile) suggests limited real-world exploitation observed despite maximum severity score. No active exploitation confirmed (not in CISA KEV). SSVC framework classifies as automatable with total technical impact but no known exploitation. Fortinet PSIRT advisory FG-IR-26-100 available but description incomplete (missing attack vector specifics). | CRITICAL | 9.8 | 0.3% | 124 |
KEV
PoC
No patch
|
| CVE-2026-21643 | A product has a SQL injection vulnerability enabling unauthenticated database compromise through improperly neutralized SQL commands. | CRITICAL | 9.8 | 0.0% | 124 |
KEV
PoC
No patch
|
| CVE-2026-35616 | Remote code execution in Fortinet FortiClientEMS versions 7.4.5 through 7.4.6 allows unauthenticated attackers to execute arbitrary code via crafted network requests. The vulnerability stems from improper access control (CWE-284) and requires no user interaction or privileges (CVSS PR:N). With a CVSS score of 9.1 (Critical) and low attack complexity, this represents a severe exposure for organizations using affected FortiClientEMS versions. The CVSS temporal metrics indicate functional exploit code exists (E:F) with an official fix available (RL:O), making this a high-priority patching target despite no confirmed active exploitation (not present in CISA KEV). | CRITICAL | 9.8 | 0.0% | 124 |
KEV
PoC
No patch
|
| CVE-2026-25089 | Unauthenticated OS command injection in Fortinet FortiSandbox (on-premise, Cloud, and PaaS variants) allows remote attackers to execute arbitrary operating system commands by sending specifically crafted HTTP requests to the management interface. The flaw carries a CVSS 9.8 rating with network-reachable, no-authentication, no-user-interaction characteristics, and no public exploit identified at time of analysis. Because FortiSandbox is a security-analysis appliance handling untrusted samples, compromise undermines the integrity of malware verdicts and downstream detections. | CRITICAL | 9.8 | 2.0% | 121 |
KEV
PoC
No patch
|
| CVE-2025-25249 | Remote code execution in Fortinet FortiOS (6.4 through 7.6.3) and FortiSwitchManager (7.0.x/7.2.x) lets an attacker run unauthorized code or commands by sending specially crafted packets to an affected device. The flaw is a heap-based buffer overflow requiring no authentication or user interaction, and it is confirmed actively exploited (CISA KEV) with publicly available exploit code, reportedly tied to a 'PivotC2' FortiGate RAT. Despite the KEV listing, EPSS is only 0.01% (2nd percentile), indicating targeted rather than mass-scanning exploitation to date. | CRITICAL | 9.8 | 0.0% | 119 |
KEV
PoC
No patch
|
| CVE-2026-24858 | Fortinet FortiAnalyzer and FortiManager contain a critical authentication bypass vulnerability (CVE-2026-24858, CVSS 9.8) that allows unauthenticated remote attackers to gain administrative access through an alternate authentication path. With EPSS 2.8% but KEV listing confirming active exploitation, this vulnerability threatens the security management infrastructure that organizations rely on to protect their networks. | CRITICAL | 9.8 | 2.8% | 112 |
KEV
PoC
No patch
|
| CVE-2025-59718 | Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to defeat FortiCloud SSO login by submitting a crafted SAML response, due to improper verification of the response's cryptographic signature. The flaw is confirmed actively exploited (CISA KEV), with Arctic Wolf observing malicious SSO logins in the wild, and EPSS rates it at the 93rd percentile of likelihood. Combined with a 9.8 CVSS score and CWE-347 root cause, this is a top-priority patching target for any organization running affected Fortinet management planes. | CRITICAL | 9.8 | 9.5% | 108 |
KEV
No patch
|
| CVE-2025-68686 | An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. [CVSS 5.9 MEDIUM] | MEDIUM | 5.9 | 0.0% | 100 |
KEV
PoC
No patch
|
| CVE-2026-39813 | Path traversal in Fortinet FortiSandbox 4.4.0-4.4.8 and 5.0.0-5.0.5 enables remote unauthenticated attackers to achieve full system compromise. With CVSS 9.8 (AV:N/AC:L/PR:N/UI:N), the vulnerability permits network-based exploitation without credentials or user interaction, leading to complete confidentiality, integrity, and availability impact. Despite critical severity, EPSS score of 0.06% (18th percentile) indicates low observed exploitation probability. No active exploitation confirmed (not in CISA KEV). SSVC framework marks it as automatable with total technical impact but no current exploitation. The incomplete CVE description (placeholder text for attack vector) suggests early disclosure; verify completeness with Fortinet advisory FG-IR-26-112. | CRITICAL | 9.8 | 0.1% | 74 |
PoC
No patch
|
| CVE-2025-64155 | Fortinet FortiSIEM (6.7.0 through 7.4.0) has OS command injection via crafted TCP requests. As a SIEM, compromise gives attackers access to all security logs and the ability to suppress alerts. PoC available. | CRITICAL | 9.8 | 0.0% | 69 |
PoC
No patch
|
| CVE-2026-55841 | Log-record tampering in Graylog's FortiGate syslog parser enables unauthenticated network senders to overwrite or erase critical security-log fields - including srcip, dstip, date, time, and tz - or cause entire log messages to be silently discarded, creating a viable log-evasion primitive. Affected are Graylog Server versions prior to 6.3.12, 7.0.7, and 7.1.2 (all branches), and Graylog Forwarder prior to version 7.3, on any deployment ingesting FortiGate key-value syslog. No public exploit code exists and this is not in CISA KEV, but the attack requires no authentication and minimal crafting skill, making it a realistic threat to security-monitoring integrity in FortiGate-centric environments. | HIGH | 7.5 | 0.4% | 58 |
PoC
|
| CVE-2026-26084 | Unauthenticated remote access control bypass in Fortinet FortiSandbox 4.2.x through 5.0.x - and its Cloud and PaaS variants - allows network-reachable attackers to retrieve sensitive information and disrupt availability by sending crafted HTTP requests, with no credentials or user interaction required. Fortinet's confirmed CVSS temporal metrics include E:P (proof-of-concept exploit code exists) alongside RL:O (official remediation available) and RC:C (confirmed), establishing this as an actively documented, patchable risk against sandboxing infrastructure that processes enterprise malware submissions. The scope-changed vector (S:C) combined with high availability impact (A:H) indicates the access control failure cascades beyond the directly targeted HTTP endpoint to other components within the FortiSandbox platform. | CRITICAL | 9.9 | 0.2% | 55 |
No patch
|
| CVE-2025-47855 | Fortinet FortiFone 7.0.0-7.0.1 and 3.0.13-3.0.23 allows unauthenticated attackers to download the complete device configuration via crafted HTTP/HTTPS requests. Configuration files contain credentials and network settings. | CRITICAL | 9.8 | 1.2% | 50 |
No patch
|