FortiOS / FortiGate 7.6 vulnerabilities
17 advisories affect Fortinet FortiOS / FortiGate 7.6, 5 already exploited by attackers. Latest: October 16, 2026.
Running FortiOS / FortiGate 7.6 devices? Get an email when a new vulnerability comes out. Free, unsubscribe in one click.
Turn on FortiOS / FortiGate 7.6 alerts
Turn on FortiOS / FortiGate 7.6 alerts
| Vulnerability | Severity | Affected versions |
|---|---|---|
| Fortinet Multiple Products Path Traversal Vulnerability CVE-2025-61624 · October 16, 2026 | Medium 6 Exploited | from 7.6.0 to 7.6.4 |
| Fortinet: GUI Denial of Service FG-IR-26-181 · October 13, 2026 | Medium 6.7 | from 7.6.4 to 7.6.6 Fixed in 7.6.7 |
| Fortinet: Double free in signal handler FG-IR-26-182 · October 13, 2026 | Low 2.1 | from 7.6.0 to 7.6.7 Fixed in 7.6.9 (in arrivo) |
| Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability CVE-2025-25249 · September 9, 2026 | High 8.1 Exploited | from 7.6.0 to 7.6.2 |
| Fortinet: ZTNA Portal Improper Certificate Validation FG-IR-26-174 · September 8, 2026 | High 8.1 | from 7.6.1 to 7.6.6 Fixed in 7.6.7 |
| Fortinet: Stack buffer overflow in WAD FG-IR-26-161 · August 12, 2026 | Medium 5.6 | from 7.6.1 to 7.6.6 Fixed in 7.6.7 |
| Fortinet: UI DoS attack FG-IR-26-162 · August 12, 2026 | Medium 5 | from 7.6.0 to 7.6.6 Fixed in 7.6.7 |
| Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability CVE-2025-68686 · July 27, 2026 | Medium 5.9 Exploited | from 7.6.0 to 7.6.1 |
| Fortinet: SSL-VPN Reflected XSS FG-IR-26-150 · July 14, 2026 | Medium 6.1 | from 7.6.0 to 7.6.6 Fixed in 7.6.7 |
| Fortinet: Path traversal in CLI command allows deletion of root file system FG-IR-26-151 · July 14, 2026 | Medium 5.5 | from 7.6.0 to 7.6.6 Fixed in 7.6.7 (in uscita) |
| Fortinet: Buffer overread in authd and wad daemon FG-IR-26-154 · July 14, 2026 | Medium 4.3 | from 7.6.0 to 7.6.3 Fixed in 7.6.4 |
| Fortinet: Header injection in Web Filter warning page FG-IR-26-152 · July 14, 2026 | Low 3.4 | from 7.6.0 to 7.6.4 Fixed in 7.6.5 |
| Fortinet: Header injection in captive portal authentication form FG-IR-26-153 · July 14, 2026 | Low 3.1 | from 7.6.0 to 7.6.4 Fixed in 7.6.5 |
| Fortinet: Restricted CLI escape using Lua FG-IR-26-143 · June 9, 2026 | Medium 6.7 | from 7.6.0 to 7.6.2 Fixed in 7.6.3 |
| Fortinet: LDAP authentication bypass in Agentless VPN and FSSO FG-IR-25-1052 · February 10, 2026 | High 8.1 | from 7.6.0 to 7.6.4 Fixed in 7.6.5 |
| Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability CVE-2026-24858 · January 27, 2026 | Critical 9.8 Exploited | from 7.6.0 to 7.6.5 |
| Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability CVE-2025-59718 · December 16, 2025 | Critical 9.8 Exploited | from 7.6.0 to 7.6.3 |
Affected versions are compiled automatically from vendor advisories and NVD and may contain errors. Where no fixed version is shown, you will find it in the official advisory linked from every page: check it there before updating.
Other FortiOS / FortiGate versions: 7.4 · 7.2 · 7.0 · 6.4 · 6.2 · 6.0