Fortinet FortiOS

16 known vulnerabilities in Fortinet FortiOS, 9 critical, 14 actively exploited, with patch priority, exploit likelihood and the news covering them.

Recently exploited

  • CVE-2025-68686 CVSS 5.9 medium · actively exploited Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
  • CVE-2026-24858 CVSS 9.8 critical · actively exploited Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability
  • CVE-2025-25249 CVSS 9.8 critical · actively exploited Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability
  • CVE-2025-59718 CVSS 9.8 critical · actively exploited Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability
  • CVE-2025-24472 CVSS 8.1 high · actively exploited Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
  • CVE-2024-55591 CVSS 9.8 critical · actively exploited Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
  • CVE-2024-23113 CVSS 9.8 critical · actively exploited Fortinet Multiple Products Format String Vulnerability
  • CVE-2024-21762 CVSS 9.8 critical · actively exploited Fortinet FortiOS Out-of-Bound Write Vulnerability
  • CVE-2023-27997 CVSS 9.8 critical · actively exploited Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability
  • CVE-2022-41328 CVSS 7.1 high · actively exploited Fortinet FortiOS Path Traversal Vulnerability

Latest vulnerabilities

  • CVE-2026-84393 CVSS 8.1 high A improper validation of certificate with host mismatch vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6, FortiProxy 7.6.2 through…
  • CVE-2026-84392 CVSS 2.7 low A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM…
  • CVE-2025-68686 CVSS 5.9 medium · actively exploited Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
  • CVE-2026-24858 CVSS 9.8 critical · actively exploited Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability
  • CVE-2025-25249 CVSS 9.8 critical · actively exploited Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability
  • CVE-2025-59718 CVSS 9.8 critical · actively exploited Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability
  • CVE-2025-24472 CVSS 8.1 high · actively exploited Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
  • CVE-2024-55591 CVSS 9.8 critical · actively exploited Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
  • CVE-2024-23113 CVSS 9.8 critical · actively exploited Fortinet Multiple Products Format String Vulnerability
  • CVE-2024-21762 CVSS 9.8 critical · actively exploited Fortinet FortiOS Out-of-Bound Write Vulnerability
  • CVE-2023-27997 CVSS 9.8 critical · actively exploited Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability
  • CVE-2022-41328 CVSS 7.1 high · actively exploited Fortinet FortiOS Path Traversal Vulnerability
  • CVE-2022-42475 CVSS 9.8 critical · actively exploited Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability
  • CVE-2021-44168 CVSS 7.8 high · actively exploited Fortinet FortiOS Arbitrary File Download
  • CVE-2019-5591 CVSS 6.5 medium · actively exploited Fortinet FortiOS Default Configuration Vulnerability
  • CVE-2020-12812 CVSS 9.8 critical · actively exploited Fortinet FortiOS SSL VPN Improper Authentication Vulnerability