30
CVEs
4
Critical
9
High
0
KEV
1
PoC
12
Unpatched C/H
3.3%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
4
HIGH
9
MEDIUM
14
LOW
3
Monthly CVE Trend
Affected Products (30)
Fortios
172
Fortiweb
87
Fortimanager
82
Fortiproxy
75
Fortianalyzer
66
Forticlient
53
Fortisandbox
37
Fortimail
35
Fortiportal
32
Fortiadc
27
Fortisiem
22
Fortipam
22
Fortimanager Cloud
22
Fortiwlm
19
Fortisoar
18
Fortinet Antivirus
17
Fortivoice
16
Fortiauthenticator
16
Fortitester
14
Fortinac
14
Fortimanager Firmware
14
Panda Antivirus
13
Rising Antivirus
12
Fortianalyzer Cloud
11
Esafe
11
Forticlientems
11
Fortiswitchmanager
11
Fortianalyzer Firmware
11
Fortiwlc
11
Open Redirect
10
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-55841 | Log-record tampering in Graylog's FortiGate syslog parser enables unauthenticated network senders to overwrite or erase critical security-log fields - including srcip, dstip, date, time, and tz - or cause entire log messages to be silently discarded, creating a viable log-evasion primitive. Affected are Graylog Server versions prior to 6.3.12, 7.0.7, and 7.1.2 (all branches), and Graylog Forwarder prior to version 7.3, on any deployment ingesting FortiGate key-value syslog. No public exploit code exists and this is not in CISA KEV, but the attack requires no authentication and minimal crafting skill, making it a realistic threat to security-monitoring integrity in FortiGate-centric environments. | HIGH | 7.5 | 0.4% | 58 |
PoC
|
| CVE-2026-26084 | Unauthenticated remote access control bypass in Fortinet FortiSandbox 4.2.x through 5.0.x - and its Cloud and PaaS variants - allows network-reachable attackers to retrieve sensitive information and disrupt availability by sending crafted HTTP requests, with no credentials or user interaction required. Fortinet's confirmed CVSS temporal metrics include E:P (proof-of-concept exploit code exists) alongside RL:O (official remediation available) and RC:C (confirmed), establishing this as an actively documented, patchable risk against sandboxing infrastructure that processes enterprise malware submissions. The scope-changed vector (S:C) combined with high availability impact (A:H) indicates the access control failure cascades beyond the directly targeted HTTP endpoint to other components within the FortiSandbox platform. | CRITICAL | 9.9 | 0.2% | 55 |
No patch
|
| CVE-2026-26035 | Authentication bypass in Fortinet FortiWeb (versions 7.0.0-7.0.12, 7.2.0-7.2.12, 7.4.0-7.4.11, 7.6.0-7.6.6, and 8.0.0-8.0.2) lets a remote unauthenticated attacker log into the GUI/CLI management interface using an arbitrary, made-up username and password, granting full administrative control of the web application firewall. Tracked as CVE-2026-26035 (EUVD-2026-57193) and rated CVSS 9.8, this is an improper-authentication (CWE-287) flaw reported by Fortinet's own PSIRT (FG-IR-26-158). There is no public exploit identified at time of analysis and it is not on the CISA KEV list, but the trivial exploitability and network exposure make it a high-priority patch. | CRITICAL | 9.8 | 0.5% | 50 |
No patch
|
| CVE-2026-84390 | Sensitive information embedded in the source code of Fortinet FortiMonitorOnSight (7.2.0-7.2.2 and 7.2.4-7.2.7) can be recovered by an attacker and leveraged to bypass access controls. The exposed data (CWE-540) may include credentials, keys, or other secrets that grant unauthorized access to protected functionality. No public exploit is identified at time of analysis, and the CVE's own attack-vector text is an unfilled placeholder, so the exact delivery path is not documented by the vendor. | CRITICAL | 9.8 | 0.5% | 49 |
No patch
|
| CVE-2026-59835 | Exposure of a scanning VM's VNC service in Fortinet FortiSandbox 5.0.0-5.0.2 and 4.4.3-4.4.8 lets an unauthenticated remote attacker reach the VNC server of the sandbox virtual machines used for malware detonation via ordinary network requests. Because these VMs run and observe live malware samples, unauthorized VNC access can expose sensitive analysis sessions and potentially allow interaction with the detonation environment. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. | HIGH | 8.6 | 0.4% | 43 |
No patch
|
| CVE-2026-59841 | Privilege escalation in Fortinet FortiSIEM Windows Agent 7.4.0 through 7.4.1 stems from an improper restriction of the agent's communication channel (CWE-923), letting an adjacent-network attacker interact with an endpoint that should be limited to trusted parties and thereby gain elevated privileges with full confidentiality, integrity, and availability impact. The flaw was disclosed by Fortinet PSIRT (FG-IR-26-155) and carries a CVSS 7.5 rating; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation is gated by high attack complexity, which materially reduces real-world likelihood despite the unauthenticated vector. | HIGH | 7.5 | 0.1% | 43 |
No patch
|
| CVE-2026-70468 | Authentication bypass in Fortinet FortiManager and FortiManager Cloud allows unauthenticated remote attackers to circumvent access controls via an alternate path or channel, potentially gaining full administrative control over managed security infrastructure. Affected version ranges span FortiManager 7.2.5 through 7.6.1 and FortiManager Cloud 7.2.5 through 7.6.1, covering multiple active release branches of this centralized network security management platform. No CISA KEV listing or confirmed public exploit has been identified at time of analysis, but the unauthenticated network vector combined with full C/I/A impact and the high-value nature of the target - a platform governing firewall policy across entire enterprise estates - elevates real-world priority significantly beyond the AC:H qualifier alone. | HIGH | 8.1 | 0.6% | 41 |
No patch
|
| CVE-2026-70465 | Remote code execution in Fortinet FortiClientWindows affects versions 7.2.0-7.2.11 and 7.4.0-7.4.3, exploitable by any attacker capable of intercepting or forging DNS responses destined for the target host. Maliciously crafted DNS response packets trigger a classic buffer overflow (CWE-120) in the client's DNS parsing logic, allowing arbitrary code execution without requiring any credentials or user interaction. No public exploit or CISA KEV listing has been identified at time of analysis, and the high attack complexity requirement (DNS MITM/poisoning position) meaningfully limits opportunistic exploitation. | HIGH | 8.1 | 0.5% | 41 |
No patch
|
| CVE-2026-71407 | Stack-based buffer overflow in Fortinet FortiOS, FortiProxy, and FortiPAM allows unauthenticated remote attackers to execute arbitrary code or commands within the WAD (Web Application Daemon) process via crafted sockets - but only on devices where the explicit proxy is simultaneously configured with Kerberos authentication and SOCKS enabled. Exploitation further requires defeating stack canary protection and ASLR, elevating real-world attack complexity well above the raw CVSS base score implies. No public exploit or active exploitation has been confirmed; Fortinet PSIRT published advisory FG-IR-26-161 disclosing the issue. | HIGH | 8.1 | 0.5% | 41 |
No patch
|
| CVE-2026-84393 | Improper certificate hostname validation (CWE-297) in Fortinet FortiOS and FortiProxy enables network-adjacent attackers to conduct man-in-the-middle attacks against outbound TLS connections made by affected devices. Fortinet FortiOS versions 7.6.1 through 7.6.6 and FortiProxy 7.6.2 through 7.6.6 fail to verify that a presented certificate matches the intended hostname, allowing a suitably positioned attacker to intercept and potentially tamper with encrypted traffic. Proof-of-concept code exists (E:P in temporal CVSS), and an official fix has been released per vendor advisory FG-IR-26-174. | HIGH | 8.1 | 0.2% | 41 |
No patch
|
| CVE-2025-53379 | Information disclosure in Fortinet FortiAuthenticator (6.5 all versions and 6.6.0–6.6.2) lets a remote unauthenticated attacker read out-of-bounds memory via a specially crafted request, exposing sensitive in-memory data. The CVSS temporal metrics (E:F, RC:C) indicate a functional, confirmed exploit is understood by the vendor, and an official fix is available (RL:O). No CISA KEV listing is present, so this is not confirmed as actively exploited despite the mature exploit signal. | HIGH | 7.5 | 0.4% | 38 |
No patch
|
| CVE-2026-84387 | Command injection in Fortinet FortiSandbox allows a remote, highly privileged attacker to execute arbitrary OS commands on the underlying system, achieving full confidentiality, integrity, and availability compromise. Affected versions span FortiSandbox 4.2.1-4.2.8, 4.4.0-4.4.9, 5.0.0-5.0.6, and 5.2.0, covering a wide release range across multiple major branches. The temporal CVSS metrics (E:F/RL:O/RC:C) confirm that a functional exploit exists and an official patch has been released, making prompt patching the priority action. | HIGH | 7.2 | 0.9% | 36 |
No patch
|
| CVE-2026-59836 | Improper TLS certificate validation in Fortinet FortiClientEMS (Endpoint Management Server) exposes sensitive information to network-positioned attackers across FortiClientEMS 7.2 (all listed builds up to 7.2.14), 7.4.0–7.4.1, and 7.4.3–7.4.5. Because the client fails to properly verify server certificates (CWE-295), an attacker able to intercept EMS communications can decrypt or observe protected traffic to disclose information. There is no public exploit identified at time of analysis and CISA SSVC scores exploitation as 'none', but Fortinet rates the flaw CVSS 9.8, so patching should be prioritized despite the lack of observed exploitation. | CRITICAL | 9.8 | 0.1% | 34 |
No patch
|
| CVE-2026-59837 | Stack-based buffer overflow in Fortinet FortiOS, FortiPAM, FortiProxy, and FortiSASE enables arbitrary code execution for a privileged authenticated attacker capable of bypassing ASLR and stack canary protections via crafted HTTP requests. The CVSS temporal metric E:P confirms proof-of-concept exploit code exists, and RL:O confirms an official patch has been released by Fortinet (advisory FG-IR-26-148). This vulnerability is not listed in CISA KEV at time of analysis, and the dual prerequisites of privileged access plus memory-protection bypass substantially constrain real-world exploitability despite the critical CIA impact triad. | MEDIUM | 6.6 | 0.6% | 34 |
No patch
|
| CVE-2026-84391 | Denial of service in Fortinet FortiAnalyzer 7.6.3 through 7.6.6 is achievable by a low-privileged remote attacker exploiting a use of uninitialized variable (CWE-457) flaw. A confirmed proof-of-concept exists per the CVSS temporal vector (E:P), and an official remediation is available per the Fortinet PSIRT advisory FG-IR-26-172. The CVE description contains a verbatim placeholder ('<insert attack vector here>') instead of the specific triggering mechanism, reducing technical precision; however, the CVSS vector (AV:N/AC:L/PR:L) confirms network-reachable exploitation requiring only low-privilege credentials. No confirmed active exploitation (CISA KEV) has been identified at time of analysis. | MEDIUM | 6.5 | 0.2% | 32 |
No patch
|