Fortinet in the CISA KEV catalog

KEV entries, newest first

Filed by CISA under the name “Fortinet”. Each row links to the CVE’s NVD record; entries added in the last 45 days also link to their place on must-patch. The due date is CISA’s remediation deadline for federal civilian agencies, as the feed states it.

1. Added October 16, 2026

   CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability

   Multiple Products · on must-patch

   Due October 19, 2026

2. Added October 1, 2026

   CVE-2026-104286 Fortinet FortiMail Path Traversal Vulnerability

   FortiMail · on must-patch

   Due October 4, 2026

3. Added September 9, 2026

   CVE-2025-25249 Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability

   Multiple Products

   Due September 12, 2026

4. Added July 27, 2026

   CVE-2025-68686 Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

   FortiOS

   Due August 10, 2026

5. Added July 16, 2026

   CVE-2026-39808 Fortinet FortiSandbox OS Command Injection Vulnerability

   FortiSandbox

   Due July 19, 2026

6. Added July 16, 2026

   CVE-2026-25089 Fortinet FortiSandbox OS Command Injection Vulnerability

   FortiSandbox

   Due July 19, 2026

7. Added April 13, 2026

   CVE-2026-21643 Fortinet FortiClient EMS SQL Injection Vulnerability

   FortiClient EMS

   Due April 16, 2026

8. Added April 6, 2026

   CVE-2026-35616 Fortinet FortiClient EMS Improper Access Control Vulnerability

   FortiClient EMS

   Due April 9, 2026

9. Added January 27, 2026

   CVE-2026-24858 Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability

   Multiple Products

   Due January 30, 2026

10. Added December 16, 2025

    CVE-2025-59718 Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability

    Multiple Products

    Due December 23, 2025

11. Added November 18, 2025

    CVE-2025-58034 Fortinet FortiWeb OS Command Injection Vulnerability

    FortiWeb

    Due November 25, 2025

12. Added November 14, 2025

    CVE-2025-64446 Fortinet FortiWeb Path Traversal Vulnerability

    FortiWeb

    Due November 21, 2025

13. Added July 18, 2025

    CVE-2025-25257 Fortinet FortiWeb SQL Injection Vulnerability

    FortiWeb

    Due August 8, 2025

14. Added June 25, 2025

    CVE-2019-6693 Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability

    FortiOS · known ransomware use

    Due July 16, 2025

15. Added May 14, 2025

    CVE-2025-32756 Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability

    Multiple Products

    Due June 4, 2025

16. Added March 18, 2025

    CVE-2025-24472 Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

    FortiOS and FortiProxy · known ransomware use

    Due April 8, 2025

17. Added January 14, 2025

    CVE-2024-55591 Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

    FortiOS and FortiProxy · known ransomware use

    Due January 21, 2025

18. Added October 23, 2024

    CVE-2024-47575 Fortinet FortiManager Missing Authentication Vulnerability

    FortiManager

    Due November 13, 2024

19. Added October 9, 2024

    CVE-2024-23113 Fortinet Multiple Products Format String Vulnerability

    Multiple Products

    Due October 30, 2024

20. Added March 25, 2024

    CVE-2023-48788 Fortinet FortiClient EMS SQL Injection Vulnerability

    FortiClient EMS · known ransomware use

    Due April 15, 2024

21. Added February 9, 2024

    CVE-2024-21762 Fortinet FortiOS Out-of-Bound Write Vulnerability

    FortiOS · known ransomware use

    Due February 16, 2024

22. Added June 13, 2023

    CVE-2023-27997 Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability

    FortiOS and FortiProxy SSL-VPN · known ransomware use

    Due July 4, 2023

23. Added March 14, 2023

    CVE-2022-41328 Fortinet FortiOS Path Traversal Vulnerability

    FortiOS

    Due April 4, 2023

24. Added December 13, 2022

    CVE-2022-42475 Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability

    FortiOS · known ransomware use

    Due January 3, 2023

25. Added October 11, 2022

    CVE-2022-40684 Fortinet Multiple Products Authentication Bypass Vulnerability

    Multiple Products · known ransomware use

    Due November 1, 2022

26. Added September 8, 2022

    CVE-2018-13374 Fortinet FortiOS and FortiADC Improper Access Control Vulnerability

    FortiOS and FortiADC · known ransomware use

    Due September 29, 2022

27. Added January 10, 2022

    CVE-2018-13383 Fortinet FortiOS and FortiProxy Out-of-bounds Write

    FortiOS and FortiProxy · known ransomware use

    Due July 10, 2022

28. Added January 10, 2022

    CVE-2018-13382 Fortinet FortiOS and FortiProxy Improper Authorization

    FortiOS and FortiProxy · known ransomware use

    Due July 10, 2022

29. Added December 10, 2021

    CVE-2021-44168 Fortinet FortiOS Arbitrary File Download

    FortiOS

    Due December 24, 2021

30. Added November 3, 2021

    CVE-2020-12812 Fortinet FortiOS SSL VPN Improper Authentication Vulnerability

    FortiOS · known ransomware use

    Due May 3, 2022

31. Added November 3, 2021

    CVE-2019-5591 Fortinet FortiOS Default Configuration Vulnerability

    FortiOS · known ransomware use

    Due May 3, 2022

32. Added November 3, 2021

    CVE-2018-13379 Fortinet FortiOS SSL VPN Path Traversal Vulnerability

    FortiOS · known ransomware use

    Due May 3, 2022

Snapshot of CISA’s feed taken November 7, 2026; the whole catalog is counted on the KEV tracker.