Fortinet FortiOS / FortiGate vulnerabilities

26 advisories, 10 actively exploited. Last update: October 16, 2026.

• CVE-2025-61624October 16, 2026Medium 6Exploited
  Fortinet Multiple Products Path Traversal Vulnerability
• FG-IR-26-181October 13, 2026Medium 6.7
  Fortinet: GUI Denial of Service
• FG-IR-26-182October 13, 2026Low 2.1
  Fortinet: Double free in signal handler
• CVE-2025-25249September 9, 2026High 8.1Exploited
  Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability
• FG-IR-26-174September 8, 2026High 8.1
  Fortinet: ZTNA Portal Improper Certificate Validation
• FG-IR-26-173September 8, 2026Low 2.5
  Fortinet: Null Pointer Dereference in Log Report
• FG-IR-26-160August 12, 2026High 8.1
  Fortinet: FGFM Authentication Weakening via CLI Configuration
• FG-IR-26-161August 12, 2026Medium 5.6
  Fortinet: Stack buffer overflow in WAD
• FG-IR-26-162August 12, 2026Medium 5
  Fortinet: UI DoS attack
• CVE-2025-68686July 27, 2026Medium 5.9Exploited
  Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
• FG-IR-26-150July 14, 2026Medium 6.1
  Fortinet: SSL-VPN Reflected XSS
• FG-IR-26-148July 14, 2026Medium 5.9
  Fortinet: Stack Buffer Overflow in Log Report
• FG-IR-26-151July 14, 2026Medium 5.5
  Fortinet: Path traversal in CLI command allows deletion of root file system
• FG-IR-26-154July 14, 2026Medium 4.3
  Fortinet: Buffer overread in authd and wad daemon
• FG-IR-26-152July 14, 2026Low 3.4
  Fortinet: Header injection in Web Filter warning page
• FG-IR-26-153July 14, 2026Low 3.1
  Fortinet: Header injection in captive portal authentication form
• FG-IR-26-143June 9, 2026Medium 6.7
  Fortinet: Restricted CLI escape using Lua
• FG-IR-25-1052February 10, 2026High 8.1
  Fortinet: LDAP authentication bypass in Agentless VPN and FSSO
• CVE-2026-24858January 27, 2026Critical 9.8Exploited
  Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability
• CVE-2025-59718December 16, 2025Critical 9.8Exploited
  Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability
• CVE-2019-6693June 25, 2025Medium 6.5Exploited
  Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability
• FG-IR-24-257June 10, 2025Medium 4.3
  Fortinet: Information Disclosure on SSLVPN endpoint
• CVE-2025-24472March 18, 2025High 8.1Exploited
  Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
• CVE-2024-55591January 14, 2025Critical 9.8Exploited
  Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
• CVE-2024-23113October 9, 2024Critical 9.8Exploited
  Fortinet Multiple Products Format String Vulnerability
• CVE-2024-21762February 9, 2024Critical 9.8Exploited
  Fortinet FortiOS Out-of-Bound Write Vulnerability