Fortinet FortiOS vulnerabilities
14 known CVE vulnerabilities in Fortinet FortiOS, translated and rated.
- CVE-2017-7738High
CVE-2017-7738 is an Information Disclosure vulnerability in Fortinet FortiOS versions 5.6.0 to 5.6.2, 5.4.0 to 5.4.5, and 5.2 and below, allowing an admin user with super_admin privileges to view current SSL VPN web portal session info, which may contain user credentials.
- CVE-2025-61624MediumActively exploited
A Path Traversal vulnerability in Fortinet FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. An authenticated attacker with admin profile and read-write permissions can exploit it to write or delete arbitrary files via specific CLI commands.
- CVE-2024-23113CriticalActively exploited
A use of externally-controlled format string in Fortinet FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager allows an attacker to execute unauthorized code or commands via specially crafted packets.
- CVE-2022-41328MediumActively exploited
A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 through 7.2.3, 7.0.0 through 7.0.9 and before 6.4.11 allows a privileged attacker to read and write files on the underlying Linux system via crafted CLI commands.
- CVE-2018-13374MediumActively exploited
An improper access control vulnerability in Fortinet FortiOS and FortiADC allows an attacker to obtain LDAP server login credentials configured in FortiGate by pointing a connectivity test to a rogue LDAP server.
- CVE-2026-106174High
An improper locking vulnerability in Fortinet FortiOS 8.0.0 and FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP requests.
- CVE-2025-67862Medium
Fortinet FortiOS and FortiProxy in multiple versions contain a vulnerability exposing an internal asset to an unsafe debug access level. This allows an authenticated admin to execute Lua scripts via crafted CLI commands.
- CVE-2025-53844High
An out-of-bounds write vulnerability in Fortinet FortiOS versions 7.6.0 through 7.6.3, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.11 allows an attacker to execute unauthorized code or commands via specially crafted packets.
- CVE-2025-62631Medium
An insufficient session expiration vulnerability [CWE-613] in Fortinet FortiOS 7.4.0, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows an attacker to maintain access to network resources via an active SSLVPN session not terminated after a user's password change under particular conditions outside of the attacker's control.
- CVE-2025-58413High
A stack-based buffer overflow vulnerability exists in Fortinet FortiOS versions 7.6.0 through 7.6.3, 7.4.0 through 7.4.8, and all versions of 7.2, 7.0, 6.4, 6.2, and 6.0. An attacker can execute unauthorized code or commands via specially crafted packets.
- CVE-2025-53843High
A stack-based buffer overflow vulnerability exists in Fortinet FortiOS versions 7.6.0 through 7.6.3, 7.4.0 through 7.4.8, and all versions of 7.2, 7.0, and 6.4. An attacker can exploit this vulnerability to execute unauthorized code or commands via specially crafted packets.
- CVE-2025-58903Low
CVE-2025-58903 in Fortinet FortiOS versions 7.6.0 through 7.6.3 and before 7.4.8 has an Unchecked Return Value vulnerability that allows an authenticated user to cause a Null Pointer Dereference, crashing the http daemon via a specially crafted request.
- CVE-2025-22258Medium
Fortinet FortiSRA, FortiPAM, FortiProxy, FortiOS, and FortiSwitchManager contain a heap-based buffer overflow vulnerability. An attacker could escalate privileges via specially crafted HTTP requests.
- CVE-2024-52963Low
An out-of-bounds write in Fortinet FortiOS versions 7.6.0, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, and 6.4.0 through 6.4.15 allows an attacker to trigger a denial of service via specially crafted packets.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS