Skip to main content
CloudKey
English Français
Request a demo

2 actively exploited

FortiProxy 7.6.0: known CVEs & fixed releases

21 CVEs affect this build · 2 in CISA KEV (actively exploited) · highest CVSS 9.8 · 5 builds behind the latest 7.6.5 · updated 2026-06-26

Patch path: upgrade to 7.0.20 or 7.0.21 or 7.0.22 or 7.2.13 or 7.2.14 or 7.2.15 or 7.4.11 or 7.4.12 or 7.4.4 or 7.4.7 or 7.4.8 or 7.4.9 or 7.6.2 or 7.6.3 or 7.6.4 or 7.6.5 to clear the exploited issues below.

  • KEV · exploited CRITICAL
    CVE-2026-24858

    Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability

    Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authentication bypass using an alternate path or channel that could allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.

    CVSS
    9.8
    EPSS
    86%
    KEV added
    2026-01-27
    Published
    2026-01-27
    NVD ↗fortiguard.fortinet.com ↗fortinet.com ↗CISA ↗
  • KEV · exploited CRITICAL
    CVE-2025-59718

    Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability

    Fortinet FortiOS, FortiSwitchMaster, FortiProxy, and FortiWeb contain an improper verification of cryptographic signature vulnerability that may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML message. Please be aware that CVE-2025-59719 pertains to the same problem and is mentioned in the same vendor advisory. Ensure to apply all patches mentioned in the advisory.

    CVSS
    9.8
    EPSS
    66%
    KEV added
    2025-12-16
    Published
    2025-12-09
    Fixed in 7.0.22, 7.2.15, 7.4.11, 7.6.4 NVD ↗fortiguard.fortinet.com ↗CISA ↗arcticwolf.com ↗
  • MEDIUM
    CVE-2025-67862

    CVE-2025-67862

    An Internal Asset Exposed to Unsafe Debug Access Level or State vulnerability [CWE-1244] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.2, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2.0 through 7.2.10, FortiOS 7.0.0 through 7.0.16, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0 all versions may allow an authenticated admin to execute lua scripts via crafted CLI commands.

    CVSS
    6.7
    EPSS
    0%
    Published
    2026-06-09
    Fixed in 7.2.15, 7.4.11, 7.6.4 NVD ↗fortiguard.fortinet.com ↗
  • MEDIUM
    CVE-2025-54821

    CVE-2025-54821

    An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.11, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.6.0, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiSASE 25.2.91 may allow an authenticated administrator to bypass the trusted host policy via crafted CLI command.

    CVSS
    6
    EPSS
    0%
    Published
    2025-11-18
    Fixed in 7.6.4 NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗
  • HIGH
    CVE-2025-57740

    CVE-2025-57740

    An Heap-based Buffer Overflow vulnerability [CWE-122] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions; FortiPAM version 1.5.0, version 1.4.2 and below, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions and FortiProxy version 7.6.2 and below, version 7.4.3 and below, 7.2 all versions, 7.0 all versions RDP bookmark connection may allow an authenticated user to execute unauthorized code via crafted requests.

    CVSS
    8.8
    Published
    2025-10-14
    Fixed in 7.4.4, 7.6.3 NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗
  • HIGH
    CVE-2025-25253

    CVE-2025-25253

    An Improper Validation of Certificate with Host Mismatch vulnerability [CWE-297] in FortiProxy version 7.6.1 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions and FortiOS version 7.6.2 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions ZTNA proxy may allow an unauthenticated attacker in a man-in-the middle position to intercept and tamper with connections to the ZTNA proxy

    CVSS
    7.5
    Published
    2025-10-14
    Fixed in 7.4.9, 7.6.2 NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗
  • HIGH
    CVE-2024-52965

    CVE-2024-52965

    A missing critical step in authentication vulnerability [CWE-304] in Fortinet FortiOS version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.10, and before 7.0.16 & FortiProxy version 7.6.0 through 7.6.1, 7.4.0 through 7.4.8, 7.2.0 through 7.2.13 and before 7.0.20 allows an API-user using api-key + PKI user certificate authentication to login even if the certificate is invalid.

    CVSS
    7.2
    Published
    2025-07-08
    Fixed in 7.0.21, 7.2.14, 7.4.9, 7.6.2 NVD ↗fortiguard.fortinet.com ↗
  • HIGH
    CVE-2025-22258

    CVE-2025-22258

    A heap-based buffer overflow in Fortinet FortiSRA 1.5.0, 1.4.0 through 1.4.2, FortiPAM 1.5.0, 1.4.0 through 1.4.2, 1.3.0 through 1.3.1, 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiProxy 7.6.0 through 7.6.1, 7.4.0 through 7.4.7, FortiOS 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.2 through 7.0.16, FortiSwitchManager 7.2.1 through 7.2.5 allows attackers to escalate their privilege via specially crafted http requests.

    CVSS
    7.2
    Published
    2025-10-14
    Fixed in 7.4.8, 7.6.2 NVD ↗fortiguard.fortinet.com ↗
  • HIGH
    CVE-2025-22252

    CVE-2025-22252

    A missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager version 7.2.5, and FortiOS versions 7.4.4 through 7.4.6 and version 7.6.0 may allow an attacker with knowledge of an existing admin account to access the device as a valid admin via an authentication bypass.

    CVSS
    7.2
    Published
    2025-05-28
    NVD ↗fortiguard.fortinet.com ↗
  • HIGH
    CVE-2025-22254

    CVE-2025-22254

    An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2.0 through 7.2.10, FortiOS 7.0.0 through 7.0.16, FortiOS 6.4.0 through 6.4.15, FortiProxy 7.6.0 through 7.6.1, FortiProxy 7.4.0 through 7.4.7, FortiWeb 7.6.0 through 7.6.1, FortiWeb 7.4.0 through 7.4.6 allows an authenticated attacker with at least read-only admin permissions to gain super-admin privileges via crafted requests to Node.js websocket module.

    CVSS
    7.2
    Published
    2025-06-10
    Fixed in 7.4.8, 7.6.2 NVD ↗fortiguard.fortinet.com ↗
  • HIGH
    CVE-2024-50571

    CVE-2024-50571

    A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.0 through 7.4.5, FortiAnalyzer 7.2.0 through 7.2.9, FortiAnalyzer 7.0.0 through 7.0.13, FortiAnalyzer 6.4 all versions, FortiAnalyzer 6.2 all versions, FortiAnalyzer 6.0 all versions, FortiAnalyzer Cloud 7.4.1 through 7.4.5, FortiAnalyzer Cloud 7.2.1 through 7.2.9, FortiAnalyzer Cloud 7.0.1 through 7.0.13, FortiAnalyzer Cloud 6.4 all versions, FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.0 through 7.4.5, FortiManager 7.2.0 through 7.2.9, FortiManager 7.0.0 through 7.0.13, FortiManager 6.4 all versions, FortiManager 6.2 all versions, FortiManager 6.0 all versions, FortiManager Cloud 7.6.2, FortiManager Cloud 7.4.1 through 7.4.5, FortiManager Cloud 7.2.1 through 7.2.9, FortiManager Cloud 7.0.1 through 7.0.13, FortiManager Cloud 6.4 all versions, FortiOS 7.6.0 through 7.6.2, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2.0 through 7.2.10, FortiOS 7.0.0 through 7.0.16, FortiOS 6.4.0 through 6.4.15, FortiOS 6.2 all versions, FortiProxy 7.6.0 through 7.6.1, FortiProxy 7.4.0 through 7.4.7, FortiProxy 7.2.0 through 7.2.12, FortiProxy 7.0.0 through 7.0.19, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1 all versions, FortiProxy 1.0 all versions allows attacker to execute unauthorized code or commands via specifically crafted requests.

    CVSS
    7.2
    Published
    2025-10-14
    Fixed in 7.0.20, 7.2.13, 7.4.8 NVD ↗fortiguard.fortinet.com ↗
  • HIGH
    CVE-2024-45324

    CVE-2024-45324

    A use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.0 through 7.4.4, version 7.2.0 through 7.2.9, version 7.0.0 through 7.0.15 and before 6.4.15, FortiProxy version 7.4.0 through 7.4.6, version 7.2.0 through 7.2.12 and before 7.0.19, FortiPAM version 1.4.0 through 1.4.2 and before 1.3.1, FortiSRA version 1.4.0 through 1.4.2 and before 1.3.1 and FortiWeb version 7.4.0 through 7.4.5, version 7.2.0 through 7.2.10 and before 7.0.10 allows a privileged attacker to execute unauthorized code or commands via specially crafted HTTP or HTTPS commands.

    CVSS
    7.2
    Published
    2025-03-11
    Fixed in 7.0.20, 7.2.13, 7.4.7 NVD ↗fortiguard.fortinet.com ↗
  • MEDIUM
    CVE-2025-22862

    CVE-2025-22862

    An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiOS 7.4.0 through 7.4.7, 7.2.0 through 7.2.11, 7.0.6 and above; and FortiProxy 7.6.0 through 7.6.2, 7.4.0 through 7.4.8, 7.2 all versions, 7.0.5 and above may allow an authenticated attacker to elevate their privileges via triggering a malicious Webhook action in the Automation Stitch component.

    CVSS
    6.7
    Published
    2025-10-02
    Fixed in 7.4.9, 7.6.3 NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗
  • MEDIUM
    CVE-2025-25248

    CVE-2025-25248

    An Integer Overflow or Wraparound vulnerability [CWE-190] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, 7.2 all versions, 6.4 all versions, FortiProxy version 7.6.2 and below, version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 2.0 all versions and FortiPAM version 1.5.0, version 1.4.2 and below, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions SSL-VPN RDP and VNC bookmarks may allow an authenticated user to affect the device SSL-VPN availability via crafted requests.

    CVSS
    6.5
    Published
    2025-08-12
    Fixed in 7.4.4, 7.6.3 NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗
  • MEDIUM
    CVE-2025-61624

    CVE-2025-61624

    An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.

    CVSS
    6.5
    Published
    2026-04-14
    Fixed in 7.4.12, 7.6.5 NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗
  • MEDIUM
    CVE-2025-47890

    CVE-2025-47890

    An URL Redirection to Untrusted Site vulnerabilities [CWE-601] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSASE 25.2.a may allow an unauthenticated attacker to perform an open redirect attack via crafted HTTP requests.

    CVSS
    6.1
    Published
    2025-10-14
    Fixed in 7.6.4 NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗
  • MEDIUM
    CVE-2025-31366

    CVE-2025-31366

    An Improper Neutralization of Input During Web Page Generation vulnerability [CWE-79] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSASE 25.2.a may allow an unauthenticated attacker to perform a reflected cross site scripting (XSS) via crafted HTTP requests.

    CVSS
    6.1
    Published
    2025-10-14
    Fixed in 7.6.4 NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗
  • MEDIUM
    CVE-2024-55599

    CVE-2024-55599

    An Improperly Implemented Security Check for Standard vulnerability [CWE-358] in FortiOS version 7.6.0, version 7.4.7 and below, 7.0 all versions, 6.4 all versions and FortiProxy version 7.6.1 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions may allow a remote unauthenticated user to bypass the DNS filter via Apple devices.

    CVSS
    5.3
    Published
    2025-07-08
    Fixed in 7.4.9, 7.6.2 NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗
  • MEDIUM
    CVE-2024-50562

    CVE-2024-50562

    An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions may allow an attacker in possession of a cookie used to log in the SSL-VPN portal to log in again, although the session has expired or was logged out.

    CVSS
    4.8
    Published
    2025-06-10
    NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗
  • MEDIUM
    CVE-2025-31514

    CVE-2025-31514

    A insertion of sensitive information into log file vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.13, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions may allow attacker to information disclosure via <insert attack vector here>

    CVSS
    4.3
    Published
    2025-10-14
    Fixed in 7.6.4 NVD ↗fortiguard.fortinet.com ↗cert-portal.siemens.com ↗
  • MEDIUM
    CVE-2025-25255

    CVE-2025-25255

    An Improperly Implemented Security Check for Standard vulnerability [CWE-358] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0.1 through 7.0.22 may allow an unauthenticated proxy user to bypass the domain fronting protection feature via crafted HTTP requests.

    CVSS
    4.3
    Published
    2025-10-14
    Fixed in 7.6.4 NVD ↗fortiguard.fortinet.com ↗

Stop checking versions by hand

Is your whole fleet exposed, not just this FortiProxy?

VulnMonitor reconciles every advisory against your real inventory and ranks what matters by actual exploitation (CISA KEV, EPSS), not raw CVSS. New CVE hits your gear, it is on your queue with the fix attached.

Start free How VulnMonitor works

Free to start · no credit card

Other FortiProxy versions