News stories · 30d
16
Advisories · 30d
1
Added to KEV · 90d
4
Actively exploited (CISA KEV)
| Added | CVE | Product | Vulnerability | Ransomware |
|---|---|---|---|---|
| 2026-10-16 | CVE-2025-61624 | Multiple Products | Fortinet Multiple Products Path Traversal Vulnerability | |
| 2026-10-01 | CVE-2026-104286 | FortiMail | Fortinet FortiMail Path Traversal Vulnerability | |
| 2026-09-09 | CVE-2025-25249 | Multiple Products | Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability | |
| 2026-07-27 | CVE-2025-68686 | FortiOS | Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability | |
| 2026-07-16 | CVE-2026-25089 | FortiSandbox | Fortinet FortiSandbox OS Command Injection Vulnerability | |
| 2026-07-16 | CVE-2026-39808 | FortiSandbox | Fortinet FortiSandbox OS Command Injection Vulnerability | |
| 2026-04-13 | CVE-2026-21643 | FortiClient EMS | Fortinet FortiClient EMS SQL Injection Vulnerability | |
| 2026-04-06 | CVE-2026-35616 | FortiClient EMS | Fortinet FortiClient EMS Improper Access Control Vulnerability | |
| 2026-01-27 | CVE-2026-24858 | Multiple Products | Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability | |
| 2025-12-16 | CVE-2025-59718 | Multiple Products | Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability | |
| 2025-11-18 | CVE-2025-58034 | FortiWeb | Fortinet FortiWeb OS Command Injection Vulnerability | |
| 2025-11-14 | CVE-2025-64446 | FortiWeb | Fortinet FortiWeb Path Traversal Vulnerability | |
| 2025-07-18 | CVE-2025-25257 | FortiWeb | Fortinet FortiWeb SQL Injection Vulnerability | |
| 2025-06-25 | CVE-2019-6693 | FortiOS | Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability | Known |
| 2025-05-14 | CVE-2025-32756 | Multiple Products | Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability | |
| 2025-03-18 | CVE-2025-24472 | FortiOS and FortiProxy | Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability | Known |
| 2025-01-14 | CVE-2024-55591 | FortiOS and FortiProxy | Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability | Known |
| 2024-10-23 | CVE-2024-47575 | FortiManager | Fortinet FortiManager Missing Authentication Vulnerability | |
| 2024-10-09 | CVE-2024-23113 | Multiple Products | Fortinet Multiple Products Format String Vulnerability | |
| 2024-03-25 | CVE-2023-48788 | FortiClient EMS | Fortinet FortiClient EMS SQL Injection Vulnerability | Known |
| 2024-02-09 | CVE-2024-21762 | FortiOS | Fortinet FortiOS Out-of-Bound Write Vulnerability | Known |
| 2023-06-13 | CVE-2023-27997 | FortiOS and FortiProxy SSL-VPN | Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability | Known |
| 2023-03-14 | CVE-2022-41328 | FortiOS | Fortinet FortiOS Path Traversal Vulnerability | |
| 2022-12-13 | CVE-2022-42475 | FortiOS | Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability | Known |
| 2022-10-11 | CVE-2022-40684 | Multiple Products | Fortinet Multiple Products Authentication Bypass Vulnerability | Known |
CVEs in the news
Timeline (last 30 days)
- Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack — SecurityWeek, 2026-10-19
- U.S. CISA adds Fortinet Multiple Products and BeyondTrust Remote Support flaws to its Known Exploited Vulnerabilities catalog — Security Affairs, 2026-10-17
- PoC Released for Critical Fortinet FortiClient EMS Authentication Bypass Vulnerability — Cybersecurity News, 2026-10-17
- PEERSTITCH malware: How Attackers Compromised 500 Firewalls Through FortiManager — Security Affairs, 2026-10-16
- PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions — The Hacker News, 2026-10-16
- Hackers Exploit Fortinet Vulnerabilities to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls — Cybersecurity News, 2026-10-15
- PoC Released for Critical Fortinet FortiClient EMS Authentication Bypass Vulnerability — Cybersecurity News, 2026-10-15
- ZDI-26-772: Fortinet FortiSandbox Admin Profile Improper Handling of Exceptional Conditions Denial-of-Service Vulnerability — ZDI Published Advisories, 2026-10-15
- Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant — Unit 42, 2026-10-14
- Citrix, Fortinet, Ivanti Patch 29 Vulnerabilities Across Their Products — SecurityWeek, 2026-10-14
- Critical FortiSandbox GUI Vulnerability Allows Remote Attackers to Bypass Authentication — Cybersecurity News +1 sources, 2026-10-13
- FortiBleed Attackers Locking Victims Out of Fortinet Devices — SecurityWeek, 2026-10-08
- FBI: Ongoing FortiBleed attacks lock out FortiGate VPN admins — BleepingComputer, 2026-10-07
- FortiBleed is still active, with attackers locking admins out of Fortinet firewalls — Help Net Security, 2026-10-07
- FBI Warns FortiBleed Remains Active After Amassing 86,644 Fortinet Device Credentials — The Hacker News, 2026-10-07
- Fortinet warns that critical flaw in FortiMail is facing exploitation — Cybersecurity Dive, 2026-10-02
- Fortinet warns of critical FortiMail flaw exploited in zero-day attacks — BleepingComputer +4 sources, 2026-10-01