Fortinet FortiOS vulnerabilities

CVEs per yearBy the year they were published

1. 20172
2. 20193
3. 20211
4. 20222
5. 202343
6. 202433
7. 202570
8. 202625

Known exploitedNewest addition to KEV first

• CVE-2025-61624

  An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0…

  Fortinet · FortiOS

  ExploitedMedium5.4
• CVE-2025-25249

  A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0…

  Fortinet · FortiSwitchManager

  ExploitedHigh7.4
• CVE-2025-68686

  An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0…

  Fortinet · FortiOS

  ExploitedMedium5.3
• CVE-2026-24858

  An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer…

  Fortinet · FortiWeb

  ExploitedCritical9.4
• CVE-2025-59718

  A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through…

  Fortinet · FortiSwitchManager

  ExploitedCritical9.1
• CVE-2025-24472

  An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12,…

  Fortinet · FortiOS

  ExploitedHigh8.1
• CVE-2024-55591

  An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0…

  Fortinet · FortiOS

  ExploitedCritical9.6
• CVE-2024-23113

  A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions…

  Fortinet · FortiSwitchManager

  ExploitedCritical9.8
• CVE-2024-21762

  A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.13, FortiOS 6.4.0 through…

  Fortinet · FortiOS

  ExploitedCritical9.6
• CVE-2023-27997

  A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and…

  Fortinet · FortiOS-6K7K

  ExploitedCritical9.2

Newest CVEs

• CVE-2026-106174

  A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network access to the device…

  Fortinet · FortiOS

  Medium6.7
• CVE-2026-106175

  A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.8, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0…

  Fortinet · FortiOS

  Low2.1
• CVE-2026-84392

  A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions,…

  Fortinet · FortiOS

  Low2.5
• CVE-2026-84393

  A improper validation of certificate with host mismatch vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6, FortiProxy 7.6.2 through 7.6.6 may allow…

  Fortinet · FortiOS

  High7.3
• CVE-2026-71407

  A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6 may allow an unauthenticated attacker who can…

  Fortinet · FortiOS

  Medium5.1
• CVE-2026-71408

  A allocation of resources without limits or throttling vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4 all versions, FortiOS 7.2 all…

  Fortinet · FortiOS

  Medium5.0
• CVE-2026-59840

  A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions,…

  Fortinet · FortiOS

  Medium4.1
• CVE-2025-43892

  A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions,…

  Fortinet · FortiOS

  Medium4.1
• CVE-2026-23573

  An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiOS 7.6.0 through…

  Fortinet · FortiOS

  Medium6.1
• CVE-2026-59839

  A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4.0 through…

  Fortinet · FortiProxy

  Medium5.0