Skip to main content
CloudKey
English Français
Request a demo

2 actively exploited

FortiGate 7.6.0: known CVEs & fixed releases

45 CVEs affect this build · 2 in CISA KEV (actively exploited) · highest CVSS 9.8 · 6 builds behind the latest 7.6.6 · updated 2026-06-26

Patch path: upgrade to 6.4.16 or 6.4.17 or 7.0.16 or 7.0.17 or 7.0.18 or 7.2.10 or 7.2.11 or 7.2.12 or 7.2.9 or 7.4.10 or 7.4.11 or 7.4.5 or 7.4.6 or 7.4.7 or 7.4.8 or 7.4.9 or 7.6.2 or 7.6.3 or 7.6.4 or 7.6.5 or 7.6.6 to clear the exploited issues below.

  • KEV · exploited CRITICAL
    CVE-2026-24858

    Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability

    Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authentication bypass using an alternate path or channel that could allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.

    CVSS
    9.8
    EPSS
    86%
    KEV added
    2026-01-27
    Published
    2026-01-27
    Fixed in 7.4.11, 7.6.6 NVD ↗fortiguard.fortinet.com ↗fortinet.com ↗CISA ↗
  • KEV · exploited CRITICAL
    CVE-2025-59718

    Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability

    Fortinet FortiOS, FortiSwitchMaster, FortiProxy, and FortiWeb contain an improper verification of cryptographic signature vulnerability that may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML message. Please be aware that CVE-2025-59719 pertains to the same problem and is mentioned in the same vendor advisory. Ensure to apply all patches mentioned in the advisory.

    CVSS
    9.8
    EPSS
    66%
    KEV added
    2025-12-16
    Published
    2025-12-09
    Fixed in 7.0.18, 7.2.12, 7.4.9, 7.6.4 NVD ↗fortiguard.fortinet.com ↗CISA ↗arcticwolf.com ↗
  • MEDIUM
    CVE-2025-25250

    CVE-2025-25250

    An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiSASE 25.1.c may allow an authenticated user to access full SSL-VPN settings via crafted URL.

    CVSS
    4.3
    EPSS
    0%
    Published
    2025-06-10
    Fixed in 7.4.8 NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗
  • MEDIUM
    CVE-2025-67862

    CVE-2025-67862

    An Internal Asset Exposed to Unsafe Debug Access Level or State vulnerability [CWE-1244] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.2, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2.0 through 7.2.10, FortiOS 7.0.0 through 7.0.16, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0 all versions may allow an authenticated admin to execute lua scripts via crafted CLI commands.

    CVSS
    6.7
    EPSS
    0%
    Published
    2026-06-09
    Fixed in 7.2.11, 7.4.8, 7.6.3 NVD ↗fortiguard.fortinet.com ↗
  • MEDIUM
    CVE-2025-54821

    CVE-2025-54821

    An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.11, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.6.0, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiSASE 25.2.91 may allow an authenticated administrator to bypass the trusted host policy via crafted CLI command.

    CVSS
    6
    EPSS
    0%
    Published
    2025-11-18
    Fixed in 7.6.4 NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗
  • CRITICAL
    CVE-2025-25249

    CVE-2025-25249

    A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets

    CVSS
    9.8
    Published
    2026-01-13
    Fixed in 6.4.17, 7.0.18, 7.2.12, 7.4.9, 7.6.4 NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗
  • CRITICAL
    CVE-2024-48884

    CVE-2024-48884

    A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.1 through 7.4.3, FortiManager Cloud 7.4.1 through 7.4.3, FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.4, FortiOS 7.2.0 through 7.2.9, FortiOS 7.0.0 through 7.0.15, FortiOS 6.4.0 through 6.4.15, FortiProxy 7.4.0 through 7.4.5, FortiProxy 7.2.0 through 7.2.11, FortiProxy 7.0.0 through 7.0.18, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1 all versions, FortiProxy 1.0 all versions may allow a remote authenticated attacker with access to the security fabric interface and port to write arbitrary files or a remote unauthenticated attacker to delete an arbitrary folder

    CVSS
    9.1
    Published
    2025-01-14
    Fixed in 6.4.16, 7.0.16, 7.2.10, 7.4.5 NVD ↗fortiguard.fortinet.com ↗
  • HIGH
    CVE-2025-57740

    CVE-2025-57740

    An Heap-based Buffer Overflow vulnerability [CWE-122] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions; FortiPAM version 1.5.0, version 1.4.2 and below, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions and FortiProxy version 7.6.2 and below, version 7.4.3 and below, 7.2 all versions, 7.0 all versions RDP bookmark connection may allow an authenticated user to execute unauthorized code via crafted requests.

    CVSS
    8.8
    Published
    2025-10-14
    Fixed in 7.2.11, 7.4.8, 7.6.3 NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗
  • HIGH
    CVE-2025-53847

    CVE-2025-53847

    A missing authentication for critical function vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiOS 6.2.9 through 6.2.17 allows attacker to execute unauthorized code or commands via specially crafted packets.

    CVSS
    8.8
    Published
    2026-04-14
    Fixed in 7.0.18, 7.2.12, 7.4.9, 7.6.4 NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗
  • HIGH
    CVE-2025-53844

    CVE-2025-53844

    A out-of-bounds write vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11 allows attacker to execute unauthorized code or commands via specially crafted packets.

    CVSS
    8.8
    Published
    2026-05-12
    Fixed in 7.2.12, 7.4.9, 7.6.4 NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗
  • HIGH
    CVE-2026-22153

    CVE-2026-22153

    An Authentication Bypass by Primary Weakness vulnerability [CWE-305] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4 may allow an unauthenticated attacker to bypass LDAP authentication of Agentless VPN or FSSO policy, when the remote LDAP server is configured in a specific way.

    CVSS
    8.1
    Published
    2026-02-10
    Fixed in 7.6.5 NVD ↗fortiguard.fortinet.com ↗
  • HIGH
    CVE-2025-25253

    CVE-2025-25253

    An Improper Validation of Certificate with Host Mismatch vulnerability [CWE-297] in FortiProxy version 7.6.1 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions and FortiOS version 7.6.2 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions ZTNA proxy may allow an unauthenticated attacker in a man-in-the middle position to intercept and tamper with connections to the ZTNA proxy

    CVSS
    7.5
    Published
    2025-10-14
    Fixed in 7.4.9, 7.6.3 NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗
  • HIGH
    CVE-2024-46670

    CVE-2024-46670

    An Out-of-bounds Read vulnerability [CWE-125] in FortiOS version 7.6.0, version 7.4.4 and below, version 7.2.9 and below and FortiSASE FortiOS tenant version 24.3.b IPsec IKE service may allow an unauthenticated remote attacker to trigger memory consumption leading to Denial of Service via crafted requests.

    CVSS
    7.5
    Published
    2025-01-14
    Fixed in 7.2.10, 7.4.5 NVD ↗fortiguard.fortinet.com ↗
  • HIGH
    CVE-2025-53843

    CVE-2025-53843

    A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to execute unauthorized code or commands via specially crafted packets

    CVSS
    7.5
    Published
    2025-11-18
    Fixed in 7.4.9, 7.6.4 NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗
  • HIGH
    CVE-2025-58413

    CVE-2025-58413

    A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiSASE 25.3.b allows attacker to execute unauthorized code or commands via specially crafted packets

    CVSS
    7.5
    Published
    2025-11-18
    Fixed in 7.4.9, 7.6.4 NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗
  • HIGH
    CVE-2024-52965

    CVE-2024-52965

    A missing critical step in authentication vulnerability [CWE-304] in Fortinet FortiOS version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.10, and before 7.0.16 & FortiProxy version 7.6.0 through 7.6.1, 7.4.0 through 7.4.8, 7.2.0 through 7.2.13 and before 7.0.20 allows an API-user using api-key + PKI user certificate authentication to login even if the certificate is invalid.

    CVSS
    7.2
    Published
    2025-07-08
    Fixed in 7.0.17, 7.2.11, 7.4.6 NVD ↗fortiguard.fortinet.com ↗
  • HIGH
    CVE-2025-22258

    CVE-2025-22258

    A heap-based buffer overflow in Fortinet FortiSRA 1.5.0, 1.4.0 through 1.4.2, FortiPAM 1.5.0, 1.4.0 through 1.4.2, 1.3.0 through 1.3.1, 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiProxy 7.6.0 through 7.6.1, 7.4.0 through 7.4.7, FortiOS 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.2 through 7.0.16, FortiSwitchManager 7.2.1 through 7.2.5 allows attackers to escalate their privilege via specially crafted http requests.

    CVSS
    7.2
    Published
    2025-10-14
    Fixed in 7.0.17, 7.2.11, 7.4.7, 7.6.3 NVD ↗fortiguard.fortinet.com ↗
  • HIGH
    CVE-2025-22252

    CVE-2025-22252

    A missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager version 7.2.5, and FortiOS versions 7.4.4 through 7.4.6 and version 7.6.0 may allow an attacker with knowledge of an existing admin account to access the device as a valid admin via an authentication bypass.

    CVSS
    7.2
    Published
    2025-05-28
    Fixed in 7.4.7 NVD ↗fortiguard.fortinet.com ↗
  • HIGH
    CVE-2025-22254

    CVE-2025-22254

    An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2.0 through 7.2.10, FortiOS 7.0.0 through 7.0.16, FortiOS 6.4.0 through 6.4.15, FortiProxy 7.6.0 through 7.6.1, FortiProxy 7.4.0 through 7.4.7, FortiWeb 7.6.0 through 7.6.1, FortiWeb 7.4.0 through 7.4.6 allows an authenticated attacker with at least read-only admin permissions to gain super-admin privileges via crafted requests to Node.js websocket module.

    CVSS
    7.2
    Published
    2025-06-10
    Fixed in 6.4.16, 7.0.17, 7.2.11, 7.4.7, 7.6.2 NVD ↗fortiguard.fortinet.com ↗
  • HIGH
    CVE-2025-53744

    CVE-2025-53744

    An incorrect privilege assignment vulnerability [CWE-266] in FortiOS Security Fabric version 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, 7.2 all versions, 7.0 all versions, 6.4 all versions, may allow a remote authenticated attacker with high privileges to escalate their privileges to super-admin via registering the device to a malicious FortiManager.

    CVSS
    7.2
    Published
    2025-08-12
    Fixed in 7.4.8, 7.6.3 NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗
  • HIGH
    CVE-2025-64157

    CVE-2025-64157

    A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0 all versions allows an authenticated admin to execute unauthorized code or commands via specifically crafted configuration.

    CVSS
    7.2
    Published
    2026-02-10
    Fixed in 7.4.10, 7.6.5 NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗
  • HIGH
    CVE-2024-50571

    CVE-2024-50571

    A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.0 through 7.4.5, FortiAnalyzer 7.2.0 through 7.2.9, FortiAnalyzer 7.0.0 through 7.0.13, FortiAnalyzer 6.4 all versions, FortiAnalyzer 6.2 all versions, FortiAnalyzer 6.0 all versions, FortiAnalyzer Cloud 7.4.1 through 7.4.5, FortiAnalyzer Cloud 7.2.1 through 7.2.9, FortiAnalyzer Cloud 7.0.1 through 7.0.13, FortiAnalyzer Cloud 6.4 all versions, FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.0 through 7.4.5, FortiManager 7.2.0 through 7.2.9, FortiManager 7.0.0 through 7.0.13, FortiManager 6.4 all versions, FortiManager 6.2 all versions, FortiManager 6.0 all versions, FortiManager Cloud 7.6.2, FortiManager Cloud 7.4.1 through 7.4.5, FortiManager Cloud 7.2.1 through 7.2.9, FortiManager Cloud 7.0.1 through 7.0.13, FortiManager Cloud 6.4 all versions, FortiOS 7.6.0 through 7.6.2, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2.0 through 7.2.10, FortiOS 7.0.0 through 7.0.16, FortiOS 6.4.0 through 6.4.15, FortiOS 6.2 all versions, FortiProxy 7.6.0 through 7.6.1, FortiProxy 7.4.0 through 7.4.7, FortiProxy 7.2.0 through 7.2.12, FortiProxy 7.0.0 through 7.0.19, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1 all versions, FortiProxy 1.0 all versions allows attacker to execute unauthorized code or commands via specifically crafted requests.

    CVSS
    7.2
    Published
    2025-10-14
    Fixed in 6.4.16, 7.0.17, 7.2.11, 7.4.7, 7.6.3 NVD ↗fortiguard.fortinet.com ↗
  • HIGH
    CVE-2024-40591

    CVE-2024-40591

    An incorrect privilege assignment vulnerability [CWE-266] in Fortinet FortiOS version 7.6.0, 7.4.0 through 7.4.4, 7.2.0 through 7.2.9 and before 7.0.15 allows an authenticated admin whose access profile has the Security Fabric permission to escalate their privileges to super-admin by connecting the targetted FortiGate to a malicious upstream FortiGate they control.

    CVSS
    7.2
    Published
    2025-02-11
    Fixed in 6.4.16, 7.0.16, 7.2.10, 7.4.5 NVD ↗fortiguard.fortinet.com ↗
  • MEDIUM
    CVE-2025-58325

    CVE-2025-58325

    An Incorrect Provision of Specified Functionality vulnerability [CWE-684] in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2.5 through 7.2.10, 7.0.0 through 7.0.15, 6.4 all versions may allow a local authenticated attacker to execute system commands via crafted CLI commands.

    CVSS
    6.7
    Published
    2025-10-14
    Fixed in 7.0.16, 7.2.11, 7.4.6 NVD ↗fortiguard.fortinet.com ↗
  • MEDIUM
    CVE-2025-24477

    CVE-2025-24477

    A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.2, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2.4 through 7.2.12 allows an attacker to escalate its privileges via a specially crafted CLI command

    CVSS
    6.7
    Published
    2025-07-15
    Fixed in 7.2.12, 7.4.8, 7.6.3 NVD ↗fortiguard.fortinet.com ↗
  • MEDIUM
    CVE-2025-24471

    CVE-2025-24471

    An Improper Certificate Validation vulnerability [CWE-295] in FortiOS version 7.6.1 and below, version 7.4.7 and below may allow an EAP verified remote user to connect from FortiClient via revoked certificate.

    CVSS
    6.5
    Published
    2025-06-10
    Fixed in 7.4.8, 7.6.2 NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗
  • MEDIUM
    CVE-2025-25248

    CVE-2025-25248

    An Integer Overflow or Wraparound vulnerability [CWE-190] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, 7.2 all versions, 6.4 all versions, FortiProxy version 7.6.2 and below, version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 2.0 all versions and FortiPAM version 1.5.0, version 1.4.2 and below, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions SSL-VPN RDP and VNC bookmarks may allow an authenticated user to affect the device SSL-VPN availability via crafted requests.

    CVSS
    6.5
    Published
    2025-08-12
    Fixed in 7.2.11, 7.4.8, 7.6.3 NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗
  • MEDIUM
    CVE-2025-61624

    CVE-2025-61624

    An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.

    CVSS
    6.5
    Published
    2026-04-14
    Fixed in 7.4.10, 7.6.5 NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗
  • MEDIUM
    CVE-2025-25252

    CVE-2025-25252

    An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4 all versions may allow a remote attacker (e.g. a former admin whose account was removed and whose session was terminated) in possession of the SAML record of a user session to access or re-open that session via re-use of SAML record.

    CVSS
    6.5
    Published
    2025-10-14
    Fixed in 7.0.17, 7.2.11, 7.4.7, 7.6.3 NVD ↗fortiguard.fortinet.com ↗
  • MEDIUM
    CVE-2025-47890

    CVE-2025-47890

    An URL Redirection to Untrusted Site vulnerabilities [CWE-601] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSASE 25.2.a may allow an unauthenticated attacker to perform an open redirect attack via crafted HTTP requests.

    CVSS
    6.1
    Published
    2025-10-14
    Fixed in 7.4.9, 7.6.4 NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗
  • MEDIUM
    CVE-2025-31366

    CVE-2025-31366

    An Improper Neutralization of Input During Web Page Generation vulnerability [CWE-79] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSASE 25.2.a may allow an unauthenticated attacker to perform a reflected cross site scripting (XSS) via crafted HTTP requests.

    CVSS
    6.1
    Published
    2025-10-14
    Fixed in 7.4.9, 7.6.4 NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗
  • MEDIUM
    CVE-2024-52963

    CVE-2024-52963

    A out-of-bounds write in Fortinet FortiOS versions 7.6.0, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4.0 through 6.4.15 allows attacker to trigger a denial of service via specially crafted packets.

    CVSS
    5.9
    Published
    2025-01-14
    Fixed in 7.2.11, 7.4.8 NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗
  • MEDIUM
    CVE-2025-68686

    CVE-2025-68686

    An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.

    CVSS
    5.9
    Published
    2026-02-10
    Fixed in 7.4.7, 7.6.2 NVD ↗fortiguard.fortinet.com ↗
  • MEDIUM
    CVE-2025-55018

    CVE-2025-55018

    An inconsistent interpretation of http requests ('http request smuggling') vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4.3 through 6.4.16 may allow an unauthenticated attacker to smuggle an unlogged http request through the firewall policies via a specially crafted header

    CVSS
    5.8
    Published
    2026-02-10
    Fixed in 7.4.10 NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗
  • MEDIUM
    CVE-2024-54021

    CVE-2024-54021

    An Improper Neutralization of CRLF Sequences in HTTP Headers ('http response splitting') vulnerability [CWE-113] in Fortinet FortiOS 7.2.0 through 7.6.0, FortiProxy 7.2.0 through 7.4.5 may allow a remote unauthenticated attacker to bypass the file filter via crafted HTTP headers.

    CVSS
    5.8
    Published
    2025-01-14
    Fixed in 7.2.9, 7.4.5 NVD ↗fortiguard.fortinet.com ↗
  • MEDIUM
    CVE-2024-46666

    CVE-2024-46666

    An allocation of resources without limits or throttling [CWE-770] vulnerability in FortiOS versions 7.6.0, versions 7.4.4 through 7.4.0, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow a remote unauthenticated attacker to prevent access to the GUI via specially crafted requests directed at specific endpoints.

    CVSS
    5.3
    Published
    2025-01-14
    Fixed in 7.2.9, 7.4.5 NVD ↗fortiguard.fortinet.com ↗
  • MEDIUM
    CVE-2024-55599

    CVE-2024-55599

    An Improperly Implemented Security Check for Standard vulnerability [CWE-358] in FortiOS version 7.6.0, version 7.4.7 and below, 7.0 all versions, 6.4 all versions and FortiProxy version 7.6.1 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions may allow a remote unauthenticated user to bypass the DNS filter via Apple devices.

    CVSS
    5.3
    Published
    2025-07-08
    Fixed in 7.2.11, 7.4.8 NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗
  • MEDIUM
    CVE-2025-22251

    CVE-2025-22251

    An improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow an unauthenticated attacker to inject unauthorized sessions via crafted FGSP session synchronization packets.

    CVSS
    5.3
    Published
    2025-06-10
    Fixed in 7.4.6 NVD ↗fortiguard.fortinet.com ↗
  • MEDIUM
    CVE-2025-58903

    CVE-2025-58903

    An Unchecked Return Value vulnerability [CWE-252] in Fortinet FortiOS version 7.6.0 through 7.6.3 and before 7.4.8 API allows an authenticated user to cause a Null Pointer Dereference, crashing the http daemon via a specialy crafted request.

    CVSS
    4.9
    Published
    2025-10-14
    Fixed in 7.4.9, 7.6.4 NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗
  • MEDIUM
    CVE-2024-50562

    CVE-2024-50562

    An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions may allow an attacker in possession of a cookie used to log in the SSL-VPN portal to log in again, although the session has expired or was logged out.

    CVSS
    4.8
    Published
    2025-06-10
    Fixed in 7.2.11, 7.4.8 NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗
  • MEDIUM
    CVE-2024-40593

    CVE-2024-40593

    A key management errors vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.2, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all versions, FortiManager 7.4.0 through 7.4.2, FortiManager 7.2.0 through 7.2.5, FortiManager 7.0 all versions, FortiManager 6.4 all versions, FortiOS 7.6.0, FortiOS 7.4.4, FortiOS 7.2.7, FortiOS 7.0.14, FortiPortal 6.0 all versions may allow an authenticated admin to retrieve a certificate's private key via the device's admin shell.

    CVSS
    4.4
    Published
    2025-12-11
    NVD ↗fortiguard.fortinet.com ↗
  • MEDIUM
    CVE-2025-31514

    CVE-2025-31514

    A insertion of sensitive information into log file vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.13, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions may allow attacker to information disclosure via <insert attack vector here>

    CVSS
    4.3
    Published
    2025-10-14
    Fixed in 7.6.4 NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗
  • MEDIUM
    CVE-2025-25255

    CVE-2025-25255

    An Improperly Implemented Security Check for Standard vulnerability [CWE-358] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0.1 through 7.0.22 may allow an unauthenticated proxy user to bypass the domain fronting protection feature via crafted HTTP requests.

    CVSS
    4.3
    Published
    2025-10-14
    Fixed in 7.6.4 NVD ↗fortiguard.fortinet.com ↗
  • MEDIUM
    CVE-2024-47569

    CVE-2024-47569

    A insertion of sensitive information into sent data vulnerability in Fortinet FortiMail 7.4.0 through 7.4.2, FortiMail 7.2.0 through 7.2.6, FortiMail 7.0 all versions, FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.1 through 7.4.3, FortiManager Cloud 7.4.1 through 7.4.3, FortiNDR 7.6.0 through 7.6.1, FortiNDR 7.4.0 through 7.4.8, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions, FortiNDR 7.0 all versions, FortiNDR 1.5 all versions, FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.4, FortiOS 7.2.0 through 7.2.8, FortiOS 7.0.0 through 7.0.15, FortiOS 6.4.0 through 6.4.15, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.4.0 through 7.4.4, FortiProxy 7.2.0 through 7.2.10, FortiProxy 7.0 all versions, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1 all versions, FortiProxy 1.0 all versions, FortiRecorder 7.2.0 through 7.2.1, FortiRecorder 7.0.0 through 7.0.4, FortiTester 7.4.0 through 7.4.2, FortiTester 7.3 all versions, FortiTester 7.2 all versions, FortiTester 7.1 all versions, FortiTester 7.0 all versions, FortiTester 4.2 all versions, FortiVoice 7.0.0 through 7.0.4, FortiVoice 6.4.0 through 6.4.9, FortiVoice 6.0.7 through 6.0.12, FortiWeb 7.6.0, FortiWeb 7.4.0 through 7.4.4, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions, FortiWeb 6.4 all versions allows attacker to disclose sensitive information via specially crafted packets.

    CVSS
    4.3
    Published
    2025-10-14
    Fixed in 6.4.16, 7.0.16, 7.2.9, 7.4.5 NVD ↗fortiguard.fortinet.com ↗
  • LOW
    CVE-2024-46665

    CVE-2024-46665

    An insertion of sensitive information into sent data vulnerability [CWE-201] in FortiOS 7.6.0, 7.4.0 through 7.4.4 may allow an attacker in a man-in-the-middle position to retrieve the RADIUS accounting server shared secret via intercepting accounting-requests.

    CVSS
    3.7
    Published
    2025-01-14
    Fixed in 7.4.5 NVD ↗fortiguard.fortinet.com ↗

Stop checking versions by hand

Is your whole fleet exposed, not just this FortiGate?

VulnMonitor reconciles every advisory against your real inventory and ranks what matters by actual exploitation (CISA KEV, EPSS), not raw CVSS. New CVE hits your gear, it is on your queue with the fix attached.

Start free How VulnMonitor works

Free to start · no credit card

Other FortiGate versions