Fortinet FortiProxy
110 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-106175 | 7.6.0 – 7.6.6 ; 7.4.0 – 7.4.14 ; 7.2.0 – 7.2.16 ; … | A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.7, FortiOS 7.4 all versions, FortiOS 7.2 all versi | LOW 2.3 | 0.1 % | ||
| CVE-2026-84392 | 7.6.0 – 7.6.6 ; 7.4.0 – 7.4.14 ; 7.2.0 – 7.2.16 | A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM 1. | LOW 2.7 | 1.1 % | ||
| CVE-2026-84393 | 7.6.2 – 7.6.6 | A improper validation of certificate with host mismatch vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6, FortiProxy 7.6.2 through 7.6. | HIGH 8.1 | 0.3 % | ||
| CVE-2026-71407 | 7.6.0 – 7.6.4 ; 7.4.0 – 7.4.11 ; 7.2.0 – 7.2.16 ; … | A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6 may allow an unauthenticated att | HIGH 8.1 | 0.5 % | ||
| CVE-2026-59840 | 7.6.0 – 7.6.5 ; 7.4.0 – 7.4.13 ; 7.2.0 – 7.2.16 ; … | A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-23573 | 7.4.0 – 7.4.3 ; 7.2.0 – 7.2.9 ; 7.0.0 – 7.0.16 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet For | MEDIUM 6.1 | 0.4 % | ||
| CVE-2026-59839 | 7.6.0 – 7.6.5 ; 7.4.0 – 7.4.13 ; 7.2.0 – 7.2.16 ; … | A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, Fort | MEDIUM 5.5 | 0.3 % | ||
| CVE-2025-62826 | 7.6.0 – 7.6.4 ; 7.4.0 – 7.4.14 ; 7.2.0 – 7.2.16 ; … | An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet F | MEDIUM 4.3 | 0.4 % | ||
| CVE-2025-62675 | 7.6.0 – 7.6.4 ; 7.4.0 – 7.4.14 ; 7.2.0 – 7.2.16 ; … | An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet F | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-59837 | 7.4.0 – 7.4.13 ; 7.2.0 – 7.2.16 | A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2 all versions, FortiPAM 1.8.0 through 1.8.2, | MEDIUM 6.6 | 0.7 % | ||
| CVE-2025-67862 | 7.6.0 – 7.6.3 ; 7.4.0 – 7.4.10 ; 7.2.0 – 7.2.14 ; … | An Internal Asset Exposed to Unsafe Debug Access Level or State vulnerability [CWE-1244] vulnerability in Fortinet FortiOS 7.6.0 through 7.6 | MEDIUM 6.7 | 0.1 % | ||
| CVE-2025-61624 | 7.6.0 – 7.6.4 ; 7.4.0 – 7.4.11 ; 7.2.0 – 7.2.16 ; … | An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7 | MEDIUM 6.5 | 1.3 % | KEV | |
| CVE-2026-24858 | 7.6.0 – 7.6.4 ; 7.4.0 – 7.4.12 ; 7.2.0 – 7.2.15 ; … | An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7. | CRITICAL 9.8 | 87 % | KEV | |
| CVE-2024-47570 | 7.4.0 – 7.4.3 ; 7.2.0 – 7.2.11 | An insertion of sensitive information into log file vulnerability [CWE-532] in FortiOS 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0 all ver | MEDIUM 6.6 | 0.4 % | ||
| CVE-2025-59718 | 7.6.0 – 7.6.3 ; 7.4.0 – 7.4.10 ; 7.2.0 – 7.2.14 ; … | A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, Forti | CRITICAL 9.8 | 68 % | KEV | |
| CVE-2025-54821 | 7.6.0 – 7.6.3 ; 7.4.0 – 7.4.13 ; 7.2.0 – 7.2.16 ; … | An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.11 | MEDIUM 6.0 | 0.2 % | ||
| CVE-2025-31514 | 7.6.0 – 7.6.3 ; 7.4.0 – 7.4.13 ; 7.2.0 – 7.2.16 ; … | A insertion of sensitive information into log file vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4 all versions, FortiOS | MEDIUM 4.3 | 0.4 % | ||
| CVE-2025-54822 | 7.4.0 – 7.4.8 ; 7.2.0 – 7.2.15 ; 7.0.0 – 7.0.22 ; … | An improper authorization vulnerability [CWE-285] vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.8, FortiO | MEDIUM 4.3 | 0.3 % | ||
| CVE-2025-25255 | 7.6.0 – 7.6.3 ; 7.4.0 – 7.4.11 ; 7.2.0 – 7.2.15 ; … | An Improperly Implemented Security Check for Standard vulnerability [CWE-358] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiPr | MEDIUM 4.8 | 0.4 % | ||
| CVE-2024-26008 | 7.4.0 – 7.4.3 ; 7.2.0 – 7.2.9 ; 7.0.0 – 7.0.22 ; … | An improper check or handling of exceptional conditions vulnerability [CWE-703] in FortiOS version 7.4.0 through 7.4.3 and before 7.2.7, For | MEDIUM 5.3 | 0.6 % | ||
| CVE-2024-47569 | 7.4.0 – 7.4.4 ; 7.2.0 – 7.2.10 ; 7.0.0 – 7.0.23 ; … | A insertion of sensitive information into sent data vulnerability in Fortinet FortiMail 7.4.0 through 7.4.2, FortiMail 7.2.0 through 7.2.6, | MEDIUM 4.3 | 0.5 % | ||
| CVE-2023-46718 | 7.4.0 – 7.4.7 ; 7.2.0 – 7.2.15 ; 7.0.0 – 7.0.22 | A stack-based buffer overflow in Fortinet FortiOS version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.7 and 7.0.0 through 7.0.12 and 6.4.6 thr | HIGH 7.8 | 0.2 % | ||
| CVE-2024-50571 | 7.6.0 – 7.6.1 ; 7.4.0 – 7.4.7 ; 7.2.0 – 7.2.12 ; … | A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.0 through 7.4.5, FortiAnalyzer 7 | HIGH 7.2 | 0.5 % | ||
| CVE-2025-31366 | 7.6.0 – 7.6.3 ; 7.4.0 – 7.4.8 ; 7.2.0 – 7.2.16 ; … | An Improper Neutralization of Input During Web Page Generation vulnerability [CWE-79] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, | MEDIUM 6.1 | 0.4 % | ||
| CVE-2025-25253 | 7.6.0 – 7.6.1 ; 7.4.0 – 7.4.8 ; 7.2.0 – 7.2.15 ; … | An Improper Validation of Certificate with Host Mismatch vulnerability [CWE-297] in FortiProxy version 7.6.1 and below, version 7.4.8 and be | HIGH 7.5 | 0.1 % | ||
| CVE-2025-22258 | 7.6.0 – 7.6.1 ; 7.4.0 – 7.4.7 | A heap-based buffer overflow in Fortinet FortiSRA 1.5.0, 1.4.0 through 1.4.2, FortiPAM 1.5.0, 1.4.0 through 1.4.2, 1.3.0 through 1.3.1, 1.2. | HIGH 7.2 | 0.6 % | ||
| CVE-2025-57740 | 7.6.0 – 7.6.2 ; 7.4.0 – 7.4.3 ; 7.2.0 – 7.2.15 ; … | An Heap-based Buffer Overflow vulnerability [CWE-122] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, | HIGH 8.8 | 0.7 % | ||
| CVE-2025-47890 | 7.6.0 – 7.6.3 ; 7.4.0 – 7.4.14 ; 7.2.0 – 7.2.16 ; … | An URL Redirection to Untrusted Site vulnerabilities [CWE-601] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through | MEDIUM 6.1 | 0.3 % | ||
| CVE-2025-22862 | 7.6.0 – 7.6.2 ; 7.4.0 – 7.4.8 ; 7.2.0 – 7.2.15 ; … | An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiOS 7.4.0 through 7.4.7, 7.2.0 through 7.2.11, 7. | MEDIUM 6.7 | 0.3 % | ||
| CVE-2024-26009 | 7.4.0 – 7.4.2 ; 7.2.0 – 7.2.8 ; 7.0.0 – 7.0.15 | An authentication bypass using an alternate path or channel [CWE-288] vulnerability in Fortinet FortiOS 6.4.0 through 6.4.15, FortiOS 6.2.0 | HIGH 8.1 | 0.7 % | ||
| CVE-2025-25248 | 7.6.0 – 7.6.2 ; 7.4.0 – 7.4.3 ; 7.2.0 – 7.2.14 ; … | An Integer Overflow or Wraparound vulnerability [CWE-190] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and be | MEDIUM 6.5 | 0.5 % | ||
| CVE-2023-45584 | 7.4.0 – 7.4.1 ; 7.2.0 – 7.2.7 ; 7.0.0 – 7.0.13 | A double free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, Fo | HIGH 7.2 | 0.6 % | ||
| CVE-2024-52965 | 7.6.0 – 7.6.1 ; 7.4.0 – 7.4.8 ; 7.2.0 – 7.2.13 ; … | A missing critical step in authentication vulnerability [CWE-304] in Fortinet FortiOS version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2. | HIGH 7.2 | 0.3 % | ||
| CVE-2024-55599 | 7.6.0 – 7.6.1 ; 7.4.0 – 7.4.8 ; 7.2.0 – 7.2.14 ; … | An Improperly Implemented Security Check for Standard vulnerability [CWE-358] in FortiOS version 7.6.0, version 7.4.7 and below, 7.0 all ver | MEDIUM 5.3 | 0.4 % | ||
| CVE-2024-50568 | 7.4.0 – 7.4.3 ; 7.2.0 – 7.2.9 ; 7.0.0 – 7.0.16 | A channel accessible by non-endpoint vulnerability [CWE-300] in Fortinet FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7 and before | MEDIUM 5.9 | 0.4 % | ||
| CVE-2023-29184 | 7.2.0 – 7.2.2 ; 7.0.0 – 7.0.8 ; 2.0.0 – 2.0.14 ; … | An incomplete cleanup vulnerability [CWE-459] in FortiOS 7.2 all versions and before & FortiProxy version 7.2.0 through 7.2.2 and before 7. | LOW 3.1 | 0.2 % | ||
| CVE-2025-22254 | 7.6.0 – 7.6.1 ; 7.4.0 – 7.4.7 | An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, | HIGH 7.2 | 0.8 % | ||
| CVE-2024-50562 | 7.6.0 ; 7.4.0 – 7.4.5 ; 7.2.0 – 7.2.14 ; … | An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and bel | MEDIUM 4.8 | 1.2 % | ||
| CVE-2025-22252 | 7.6.0 – 7.6.1 | A missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager version 7.2.5, and Fo | CRITICAL 9.0 | 0.9 % | ||
| CVE-2024-26013 | 7.4.0 – 7.4.2 ; 7.2.0 – 7.2.9 ; 7.0.0 – 7.0.15 ; … | A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS version 7.4.0 through 7.4. | HIGH 7.5 | 0.5 % | ||
| CVE-2023-37930 | 7.2.0 – 7.2.6 ; 7.0.0 – 7.0.12 | Multiple issues including the use of uninitialized ressources [CWE-908] and excessive iteration [CWE-834] vulnerabilities vulnerability in F | HIGH 8.8 | 0.6 % | ||
| CVE-2023-25610 | 7.2.0 – 7.2.2 ; 7.0.0 – 7.0.8 ; 2.0.0 – 2.0.14 ; … | A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, vers | CRITICAL 9.8 | 18 % | ||
| CVE-2019-15706 | 2.0.0 ; 1.2.0 – 1.2.9 | An improper neutralization of input during web page generation in the SSL VPN portal of FortiProxy version 2.0.0, version 1.2.9 and below an | MEDIUM 5.4 | 0.4 % | ||
| CVE-2024-26006 | 7.4.0 – 7.4.3 ; 7.2.0 – 7.2.9 ; 7.0.0 – 7.0.16 | An improper neutralization of input during web page Generation vulnerability [CWE-79] in FortiOS version 7.4.3 and below, version 7.2.7 and | MEDIUM 6.9 | 0.6 % | ||
| CVE-2024-45324 | 7.6.0 ; 7.4.0 – 7.4.6 ; 7.2.0 – 7.2.12 ; … | A use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.0 through 7.4.4, version 7.2.0 through 7.2.9, ve | HIGH 7.2 | 0.7 % | ||
| CVE-2025-24472 | 7.2.0 – 7.2.12 ; 7.0.0 – 7.0.19 | An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7. | HIGH 8.1 | 7.2 % | KEV | |
| CVE-2023-40721 | 7.4.0 ; 7.2.0 – 7.2.6 ; 7.0.0 – 7.0.14 ; … | A use of externally-controlled format string vulnerability [CWE-134] vulnerability in Fortinet allows a privileged attacker to execute arbi | MEDIUM 6.7 | 0.2 % | ||
| CVE-2022-23439 | | A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafte | MEDIUM 6.1 | 0.4 % | ||
| CVE-2024-54021 | 7.4.0 – 7.4.5 ; 7.2.0 – 7.2.11 | An Improper Neutralization of CRLF Sequences in HTTP Headers ('http response splitting') vulnerability [CWE-113] in Fortinet FortiOS 7.2.0 t | MEDIUM 6.4 | 0.8 % | ||
| CVE-2024-48886 | 7.4.0 – 7.4.4 ; 7.2.0 – 7.2.10 ; 7.0.0 – 7.0.17 ; … | A weak authentication in Fortinet FortiOS versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, For | CRITICAL 9.8 | 0.5 % | ||
| CVE-2024-48884 | 7.4.0 – 7.4.5 ; 7.2.0 – 7.2.11 ; 7.0.0 – 7.0.18 ; … | A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiManager 7.6.0 through 7.6.1, | CRITICAL 9.1 | 15 % | ||
| CVE-2023-46715 | 7.4.0 – 7.4.1 ; 7.2.0 – 7.2.6 ; 7.0.0 – 7.0.12 | An origin validation error [CWE-346] vulnerability in Fortinet FortiOS IPSec VPN version 7.4.0 through 7.4.1 and version 7.2.6 and below al | MEDIUM 4.7 | 0.9 % | ||
| CVE-2024-46670 | 7.4.0 – 7.4.5 ; 7.2.0 – 7.2.11 ; 7.0.0 – 7.0.18 ; … | An Out-of-bounds Read vulnerability [CWE-125] in FortiOS version 7.6.0, version 7.4.4 and below, version 7.2.9 and below and FortiSASE Forti | HIGH 7.5 | 0.6 % | ||
| CVE-2024-55591 | 7.2.0 – 7.2.12 ; 7.0.0 – 7.0.19 | An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and Forti | CRITICAL 9.8 | 94 % | KEV | |
| CVE-2024-52963 | 7.4.0 – 7.4.5 ; 7.2.0 – 7.2.13 ; 7.0.0 – 7.0.20 ; … | A out-of-bounds write in Fortinet FortiOS versions 7.6.0, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4.0 through 6.4 | MEDIUM 5.9 | 0.8 % | ||
| CVE-2024-26011 | | A missing authentication for critical function vulnerability in Fortinet FortiManager 7.4.0 through 7.4.2, FortiManager 7.2.0 through 7.2.4, | CRITICAL 9.8 | 0.6 % | ||
| CVE-2024-33510 | 7.4.0 – 7.4.3 ; 7.2.0 – 7.2.9 ; 7.0.0 – 7.0.16 | An improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability [CWE-74] in FortiOS vers | MEDIUM 4.3 | 0.6 % | ||
| CVE-2022-45862 | 7.2.0 – 7.2.11 ; 7.0.0 – 7.0.18 | An insufficient session expiration vulnerability [CWE-613] vulnerability in FortiOS 7.2.5 and below, 7.0 all versions, 6.4 all versions; For | HIGH 8.8 | 0.4 % | ||
| CVE-2024-26015 | 7.4.0 – 7.4.3 ; 7.2.0 – 7.2.10 ; 7.0.0 – 7.0.18 | An incorrect parsing of numbers with different radices vulnerability [CWE-1389] in FortiProxy version 7.4.3 and below, version 7.2.10 and be | MEDIUM 4.7 | 0.5 % | ||
| CVE-2024-26010 | 7.4.0 – 7.4.3 ; 7.2.0 – 7.2.9 ; 7.0.0 – 7.0.16 ; … | A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.3, FortiOS 7.2.0 through 7.2.7, FortiOS 7.0.0 through 7.0. | HIGH 7.5 | 0.8 % | ||
| CVE-2024-21754 | 7.4.0 – 7.4.2 ; 7.2.0 – 7.2.10 ; 7.0.0 – 7.0.17 ; … | A use of password hash with insufficient computational effort vulnerability [CWE-916] affecting FortiOS version 7.4.3 and below, 7.2 all ver | MEDIUM 4.4 | 3.5 % | ||
| CVE-2024-23111 | 7.4.0 – 7.4.2 ; 7.2.0 – 7.2.8 ; 7.0.0 – 7.0.14 | An improper neutralization of input during web page Generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiOS version 7.4.3 and | MEDIUM 6.2 | 1.0 % | ||
| CVE-2023-36640 | 7.2.0 – 7.2.5 ; 7.0.0 – 7.0.11 ; 2.0.0 – 2.0.14 ; … | A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions, | MEDIUM 6.7 | 0.3 % | ||
| CVE-2023-45583 | 7.2.0 – 7.2.5 ; 7.0.0 – 7.0.11 ; 2.0.0 – 2.0.14 ; … | A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions, | HIGH 7.2 | 0.7 % | ||
| CVE-2023-45586 | 7.4.0 – 7.4.1 ; 7.2.0 – 7.2.7 ; 7.0.0 – 7.0.13 ; … | An insufficient verification of data authenticity vulnerability [CWE-345] in Fortinet FortiOS SSL-VPN tunnel mode version 7.4.0 through 7.4. | MEDIUM 5.0 | 0.3 % | ||
| CVE-2023-41677 | 7.4.0 – 7.4.1 ; 7.2.0 – 7.2.7 ; 7.0.0 – 7.0.13 ; … | A insufficiently protected credentials vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 thr | HIGH 8.8 | 0.8 % | ||
| CVE-2023-42789 | 7.4.0 ; 7.2.0 – 7.2.6 ; 7.0.0 – 7.0.12 ; … | A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, Fort | CRITICAL 9.8 | 3.3 % | ||
| CVE-2024-23112 | 7.4.0 – 7.4.2 ; 7.2.0 – 7.2.8 ; 7.0.0 – 7.0.14 | An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiOS version 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0 | HIGH 7.2 | 0.7 % | ||
| CVE-2023-42790 | 7.4.0 ; 7.2.0 – 7.2.6 ; 7.0.0 – 7.0.12 ; … | A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0. | HIGH 8.1 | 1.1 % | ||
| CVE-2023-29180 | 7.2.0 – 7.2.3 ; 7.0.0 – 7.0.10 ; 2.0.0 – 2.0.12 ; … | A null pointer dereference vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4, FortiOS 7.0.0 through 7.0.11, FortiOS 6.4.0 through 6.4.12 | HIGH 7.5 | 2.8 % | ||
| CVE-2023-29179 | 7.2.0 – 7.2.4 ; 7.0.0 – 7.0.10 | A null pointer dereference in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, Fortiproxy version 7 | MEDIUM 6.5 | 2.5 % | ||
| CVE-2023-29181 | 7.2.0 – 7.2.4 ; 7.0.0 – 7.0.10 ; 2.0.0 – 2.0.12 ; … | A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4, FortiOS 7.0.0 through 7.0.11, FortiOS 6. | HIGH 8.8 | 0.7 % | ||
| CVE-2024-23113 | 7.4.0 – 7.4.2 ; 7.2.0 – 7.2.8 ; 7.0.0 – 7.0.15 | A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, Fo | CRITICAL 9.8 | 62 % | KEV | |
| CVE-2024-21762 | 7.4.0 – 7.4.2 ; 7.2.0 – 7.2.8 ; 7.0.0 – 7.0.14 ; … | A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.13, Fort | CRITICAL 9.8 | 85 % | KEV | |
| CVE-2023-44250 | 7.4.0 – 7.4.1 | An improper privilege management vulnerability [CWE-269] in a Fortinet FortiOS HA cluster version 7.4.0 through 7.4.1 and 7.2.5 and in a For | HIGH 8.8 | 0.9 % | ||
| CVE-2023-47536 | 7.2.0 – 7.2.3 ; 7.0.0 – 7.0.9 ; 2.0.0 – 2.0.12 | An improper access control vulnerability [CWE-284] in FortiOS version 7.2.0, version 7.0.13 and below, version 6.4.14 and below and FortiPro | MEDIUM 5.3 | 0.6 % | ||
| CVE-2023-36639 | 7.2.0 – 7.2.4 ; 7.0.0 – 7.0.10 | A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, FortiOS versions 7.4 | HIGH 8.8 | 1.1 % | ||
| CVE-2023-28002 | 7.4.0 – 7.4.1 ; 7.2.0 – 7.2.8 ; 7.0.0 – 7.0.19 ; … | An improper validation of integrity check value vulnerability [CWE-354] in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.12, 6.4 all versio | MEDIUM 6.7 | 0.2 % | ||
| CVE-2023-36641 | 7.2.0 – 7.2.4 ; 7.0.0 – 7.0.10 ; 2.0.0 – 2.0.14 ; … | A numeric truncation error vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4 a | MEDIUM 6.5 | 1.4 % | ||
| CVE-2023-41675 | 7.2.0 – 7.2.2 ; 7.0.0 – 7.0.8 | A use after free vulnerability [CWE-416] in FortiOS version 7.2.0 through 7.2.4 and version 7.0.0 through 7.0.10 and FortiProxy version 7.2. | MEDIUM 5.3 | 1.4 % | ||
| CVE-2023-29183 | 7.2.0 – 7.2.4 ; 7.0.0 – 7.0.10 | An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiProxy 7.2.0 through 7 | HIGH 7.3 | 1.3 % | ||
| CVE-2023-33308 | 7.2.0 – 7.2.2 ; 7.0.0 – 7.0.9 | A stack-based overflow vulnerability [CWE-124] in Fortinet FortiOS version 7.0.0 through 7.0.10 and 7.2.0 through 7.2.3 and FortiProxy versi | CRITICAL 9.8 | 2.1 % | ||
| CVE-2023-33307 | 7.2.0 – 7.2.2 ; 7.0.0 – 7.0.8 | A null pointer dereference in Fortinet FortiOS before 7.2.5 and before 7.0.11, FortiProxy before 7.2.3 and before 7.0.9 allows attacker to d | MEDIUM 6.5 | 0.6 % | ||
| CVE-2023-33306 | 7.2.0 – 7.2.3 ; 7.0.0 – 7.0.9 | A null pointer dereference in Fortinet FortiOS before 7.2.5, before 7.0.11 and before 6.4.13, FortiProxy before 7.2.4 and before 7.0.10 all | MEDIUM 6.5 | 0.8 % | ||
| CVE-2023-33305 | 7.2.0 – 7.2.3 ; 7.0.0 – 7.0.9 ; 2.0.0 – 2.0.12 ; … | A loop with unreachable exit condition ('infinite loop') in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS version 7.0.0 through 7.0. | MEDIUM 6.5 | 0.8 % | ||
| CVE-2023-29178 | 7.2.0 – 7.2.3 ; 7.0.0 – 7.0.9 ; 2.0.0 – 2.0.14 ; … | A access of uninitialized pointer vulnerability [CWE-824] vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4, FortiOS 7.0.0 through 7.0.1 | MEDIUM 4.3 | 0.9 % | ||
| CVE-2023-29175 | 7.2.0 – 7.2.3 ; 7.0.0 – 7.0.9 ; 2.0.0 – 2.0.14 | An improper certificate validation vulnerability [CWE-295] in FortiOS 6.2 all versions, 6.4 all versions, 7.0.0 through 7.0.10, 7.2.0 and Fo | MEDIUM 4.8 | 0.2 % | ||
| CVE-2023-27997 | 7.2.0 – 7.2.3 ; 7.0.0 – 7.0.9 ; 2.0.0 – 2.0.12 ; … | A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, | CRITICAL 9.8 | 86 % | KEV | |
| CVE-2023-26207 | 7.2.0 – 7.2.1 ; 7.0.0 – 7.0.10 | An insertion of sensitive information into log file vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4 and FortiProxy 7.0.0 through 7.0.1 | MEDIUM 6.5 | 0.5 % | ||
| CVE-2023-22639 | 7.2.0 – 7.2.2 ; 7.0.0 – 7.0.8 ; 2.0.0 – 2.0.12 ; … | A out-of-bounds write in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.10, FortiOS version 6.4.0 through 6 | HIGH 7.8 | 0.2 % | ||
| CVE-2022-43953 | 7.2.0 – 7.2.1 ; 7.0.0 – 7.0.7 | A use of externally-controlled format string in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS all versions 7.0, FortiOS all versions | HIGH 7.8 | 0.2 % | ||
| CVE-2022-42474 | 7.2.0 – 7.2.1 ; 7.0.0 – 7.0.7 ; 2.0.0 – 2.0.11 ; … | A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9 and before 6.4 | MEDIUM 6.2 | 0.6 % | ||
| CVE-2022-41327 | 7.2.0 – 7.2.1 ; 7.0.0 – 7.0.7 | A cleartext transmission of sensitive information vulnerability [CWE-319] in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0 | HIGH 7.6 | 0.1 % | ||
| CVE-2023-22640 | 7.2.0 – 7.2.1 ; 7.0.0 – 7.0.7 ; 2.0.0 – 2.0.14 ; … | A out-of-bounds write vulnerability in Fortinet FortiOS 7.2.0 through 7.2.3, FortiOS 7.0.0 through 7.0.10, FortiOS 6.4.0 through 6.4.11, For | HIGH 8.8 | 0.9 % | ||
| CVE-2022-43947 | 7.2.0 – 7.2.1 ; 7.0.0 – 7.0.7 ; 2.0.0 – 2.0.12 ; … | An improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiOS version 7.2.0 through 7.2.3 and bef | HIGH 8.8 | 0.4 % | ||
| CVE-2023-22641 | 7.2.0 – 7.2.2 ; 7.0.0 – 7.0.8 ; 2.0.0 – 2.0.12 ; … | A url redirection to untrusted site ('open redirect') in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.9, | MEDIUM 5.4 | 0.3 % | ||
| CVE-2022-41330 | 7.2.0 – 7.2.1 ; 7.0.0 – 7.0.7 | An improper neutralization of input during web page generation vulnerability ('Cross-site Scripting') [CWE-79] in Fortinet FortiOS version 7 | HIGH 8.3 | 0.6 % | ||
| CVE-2022-41329 | 7.2.0 – 7.2.2 ; 7.0.0 – 7.0.8 | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in Fortinet FortiProxy version 7.2.0 through 7.2.1 and | MEDIUM 5.3 | 0.6 % | ||
| CVE-2022-42476 | 7.2.0 – 7.2.1 ; 7.0.0 – 7.0.7 ; 2.0.0 – 2.0.11 ; … | A relative path traversal vulnerability [CWE-23] vulnerability in Fortinet FortiOS 7.2.0 through 7.2.3, FortiOS 7.0.0 through 7.0.8, FortiOS | HIGH 8.2 | 0.2 % | ||
| CVE-2022-45861 | 7.2.0 – 7.2.1 ; 7.0.0 – 7.0.7 ; 2.0.0 – 2.0.11 ; … | An access of uninitialized pointer vulnerability [CWE-824] in the SSL VPN portal of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7. | MEDIUM 6.5 | 0.8 % | ||
| CVE-2022-29054 | 7.2.0 – 7.2.1 ; 7.0.0 – 7.0.7 ; 2.0.0 – 2.0.11 ; … | A missing cryptographic steps vulnerability [CWE-325] in the functions that encrypt the DHCP and DNS keys in Fortinet FortiOS version 7.2.0, | LOW 3.3 | 0.2 % | ||
| CVE-2022-42472 | 7.2.0 – 7.2.1 ; 7.0.0 – 7.0.7 ; 2.0.0 – 2.0.10 ; … | A improper neutralization of crlf sequences in http headers ('http response splitting') vulnerability in Fortinet FortiOS 7.2.0 through 7.2. | MEDIUM 5.4 | 0.5 % | ||
| CVE-2022-38378 | 7.2.0 – 7.2.1 ; 7.0.0 – 7.0.7 ; 2.0.0 – 2.0.11 ; … | An improper privilege management vulnerability [CWE-269] in Fortinet FortiOS version 7.2.0 and before 7.0.7 and FortiProxy version 7.2.0 thr | MEDIUM 6.0 | 0.2 % | ||
| CVE-2022-39948 | 7.0.0 – 7.0.6 ; 2.0.0 – 2.0.11 ; 1.2.0 – 1.2.13 | An improper certificate validation vulnerability [CWE-295] in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.7, 6.4 all versions, 6.2 all ve | HIGH 7.4 | 0.3 % | ||
| CVE-2021-43074 | 7.0.0 – 7.0.1 ; 2.0.0 – 2.0.7 ; 1.2.0 – 1.2.13 ; … | An improper verification of cryptographic signature vulnerability [CWE-347] in FortiWeb 6.4 all versions, 6.3.16 and below, 6.2 all versions | MEDIUM 4.3 | 0.3 % | ||
| CVE-2022-41335 | 7.2.0 – 7.2.1 ; 7.0.0 – 7.0.7 ; 2.0.0 – 2.0.11 ; … | A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.10, For | HIGH 8.6 | 0.9 % | ||
| CVE-2022-42475 | 7.2.0 – 7.2.1 ; 7.0.0 – 7.0.7 ; 2.0.0 – 2.0.11 ; … | A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2. | CRITICAL 9.8 | 99 % | KEV | |
| CVE-2022-40680 | 7.0.0 – 7.0.1 ; 2.0.0 – 2.0.11 ; 1.2.0 – 1.2.13 ; … | A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiOS 6.0.7 - 6.0.15, 6.2.2 - 6.2.12, 6 | MEDIUM 5.4 | 0.4 % | ||
| CVE-2022-35843 | 7.0.0 – 7.0.5 ; 2.0.0 – 2.0.10 ; 1.2.0 – 1.2.13 | An authentication bypass by assumed-immutable data vulnerability [CWE-302] in the FortiOS SSH login component 7.2.0, 7.0.0 through 7.0.7, | CRITICAL 9.8 | 0.9 % | ||
| CVE-2021-42757 | 7.0.0 – 7.0.1 ; 2.0.0 – 2.0.7 ; 1.2.0 – 1.2.13 ; … | A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated l | MEDIUM 6.7 | 0.5 % |