Fortinet vulnerabilities

CVEs per yearBy the year they were published

1. 20177
2. 201917
3. 20197
4. 202136
5. 2023158
6. 2024185
7. 2024142
8. 2025175
9. 202535
10. 202684
11. 2026131

Known exploitedNewest addition to KEV first

• CVE-2025-61624

  An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0…

  Fortinet · FortiOS

  ExploitedMedium5.4
• CVE-2026-104286

  An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0…

  Fortinet · FortiMail

  ExploitedCritical9.8
• CVE-2025-25249

  A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0…

  Fortinet · FortiSwitchManager

  ExploitedHigh7.4
• CVE-2025-68686

  An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0…

  Fortinet · FortiOS

  ExploitedMedium5.3
• CVE-2026-25089

  A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5,…

  Fortinet · FortiSandbox

  ExploitedCritical9.1
• CVE-2026-39808

  A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may…

  Fortinet · FortiSandbox

  ExploitedCritical9.1
• CVE-2026-21643

  An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an…

  Fortinet · FortiClientEMS

  ExploitedCritical9.1
• CVE-2026-35616

  A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or…

  Fortinet · FortiClientEMS

  ExploitedCritical9.1
• CVE-2026-24858

  An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer…

  Fortinet · FortiWeb

  ExploitedCritical9.4
• CVE-2025-59718

  A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through…

  Fortinet · FortiSwitchManager

  ExploitedCritical9.1

Newest CVEs

• CVE-2026-106174

  A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network access to the device…

  Fortinet · FortiOS

  Medium6.7
• CVE-2026-107656

  An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9,…

  Fortinet · FortiSandbox

  Critical9.6
• CVE-2026-106175

  A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.8, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0…

  Fortinet · FortiOS

  Low2.1
• CVE-2026-106172

  A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all…

  Fortinet · FortiSandbox

  Medium4.9
• CVE-2026-23707

  An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0…

  Fortinet · FortiManager Cloud

  Medium6.5
• CVE-2026-23706

  An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0…

  Fortinet · FortiAnalyzer Cloud

  Medium5.9
• CVE-2026-23705

  An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0…

  Fortinet · FortiAnalyzer

  Medium6.5
• CVE-2025-46773

  An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0…

  Fortinet · FortiAnalyzer Cloud

  High7.9
• CVE-2025-57739

  An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0…

  Fortinet · FortiMail

  High7.7
• CVE-2026-106170

  An Uncaught Exception vulnerability [CWE-248] vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4…

  Fortinet · FortiSandbox

  Medium4.8