FortiOS vulnerabilities
29 known CVE vulnerabilities in FortiOS, translated and rated.
- CVE-2015-7361High
FortiOS version 5.2.3, when configured for High Availability (HA) with the dedicated management interface enabled, does not require authentication for access to the ZebOS shell on this interface. This allows remote attackers to gain shell access via unspecified vectors.
- CVE-2025-68686MediumActively exploited
A vulnerability in Fortinet FortiOS allows a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases. The attack requires prior compromise of the product via another vulnerability at the filesystem level.
- CVE-2025-24472HighActively exploited
An authentication bypass vulnerability in FortiOS and FortiProxy allows a remote unauthenticated attacker, with prior knowledge of upstream and downstream device serial numbers, to gain super-admin privileges on the downstream device if Security Fabric is enabled. The attack is carried out via crafted CSF proxy requests.
- CVE-2024-55591CriticalActively exploited
An authentication bypass vulnerability in FortiOS and FortiProxy using an alternate path or channel. A remote attacker can gain super-admin privileges by sending crafted requests to the Node.js websocket module.
- CVE-2023-42789Critical
An out-of-bounds write vulnerability in Fortinet FortiOS, FortiProxy, and FortiSASE allows an attacker to execute unauthorized code or commands via specially crafted HTTP requests.
- CVE-2022-40684CriticalActively exploited
An authentication bypass vulnerability in FortiOS, FortiProxy, and FortiSwitchManager allows an unauthenticated attacker to perform operations on the administrative interface via crafted HTTP or HTTPS requests.
- CVE-2021-44168LowActively exploited
A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attacker to download arbitrary files on the device via specially crafted update packages.
- CVE-2019-5591MediumActively exploited
A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server.
- CVE-2020-12812CriticalActively exploited
An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if they changed the case of their username.
- CVE-2019-6693MediumActively exploited
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).
- CVE-2026-71408Medium
An allocation of resources without limits or throttling vulnerability in Fortinet FortiOS may allow an unauthenticated attacker to perform a slow HTTP DoS attack on the web interface via crafted HTTP requests.
- CVE-2026-71407Medium
Fortinet FortiOS versions 7.6.1-7.6.6 have a stack-based buffer overflow vulnerability (CWE-121) that may allow an unauthenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands in the context of the WAD daemon, but only if the explicit proxy is configured with Kerberos authentication and SOCKS enabled.
- CVE-2026-59840Medium
A buffer over-read vulnerability in Fortinet FortiOS and FortiProxy allows an attacker to disclose information by reading beyond the allocated buffer. This issue affects multiple versions of these products.
- CVE-2026-59839Medium
A path traversal vulnerability in FortiOS, FortiPAM, and FortiProxy allows an attacker to execute unauthorized code or commands by manipulating file paths.
- CVE-2026-59837Medium
A stack-based buffer overflow in Fortinet FortiOS, FortiPAM and FortiProxy may allow a privileged authenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands via crafted HTTP requests.
- CVE-2026-23573Medium
A Cross-Site Scripting (XSS) vulnerability in FortiOS, FortiPAM, and FortiProxy allows an authenticated remote user to execute code or commands via crafted requests.
- CVE-2025-62826Low
An HTTP Response Splitting vulnerability in FortiOS and FortiProxy allows an attacker to inject arbitrary HTTP headers via crafted captive portal authentication requests. Affected versions include FortiOS 7.6.0-7.6.4, 7.4.x, 7.2.x and FortiProxy 7.6.0-7.6.4, 7.4.x, 7.2.x.
- CVE-2025-62675Low
An HTTP Response Splitting vulnerability in FortiOS and FortiProxy allows an attacker with a valid web filter override token to inject arbitrary HTTP headers by tricking a user into clicking a crafted link.
- CVE-2025-43892Medium
A buffer over-read vulnerability in Fortinet FortiOS allows an authenticated remote attacker to read a portion of device memory by submitting a specially crafted request. The issue affects multiple FortiOS versions from 6.4 to 7.6.3.
- CVE-2025-53847Medium
A missing authentication for critical function vulnerability in Fortinet FortiOS versions 7.6.0 through 7.6.3, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11, 7.0.0 through 7.0.17, 6.4 all versions, 6.2.9 through 6.2.17 allows attacker to execute unauthorized code or commands via specially crafted packets.
- CVE-2024-47570Medium
A vulnerability in FortiOS, FortiProxy, FortiPAM, and FortiSRA involves insertion of sensitive information into log files. A read-only administrator can retrieve API tokens of other administrators by observing REST API logs, if REST API logging is enabled (non-default configuration).
- CVE-2025-58325High
An Incorrect Provision of Specified Functionality vulnerability [CWE-684] in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2.5 through 7.2.10, 7.0.0 through 7.0.15, 6.4 all versions may allow a local authenticated attacker to execute system commands via crafted CLI commands.
- CVE-2025-47890Low
A CWE-601 URL Redirection to Untrusted Site vulnerability in Fortinet FortiOS, FortiProxy, and FortiSASE allows an unauthenticated attacker to perform an open redirect attack via crafted HTTP requests. The issue affects multiple versions including FortiOS 7.6.0-7.6.3, 7.4.0-7.4.8, 7.0.x, 7.2.x, 6.4.x, FortiProxy 7.6.0-7.6.3, 7.4.x, 7.2.x, 7.0.x, and FortiSASE 25.2.a.
- CVE-2025-31366Medium
A reflected XSS vulnerability in FortiOS, FortiProxy, and FortiSASE allows an unauthenticated attacker to execute scripts in a victim's browser via crafted HTTP requests. The issue stems from improper input neutralization during web page generation.
- CVE-2025-25255Medium
An improperly implemented security check (CWE-358) in Fortinet FortiOS and FortiProxy may allow an unauthenticated proxy user to bypass the domain fronting protection feature via crafted HTTP requests.
- CVE-2023-46718Medium
A stack-based buffer overflow in Fortinet FortiOS versions 7.4.0 through 7.4.1, 7.2.0 through 7.2.7, 7.0.0 through 7.0.12, 6.4.6 through 6.4.15, 6.2.9 through 6.2.16, and 6.0.13 through 6.0.18 allows an attacker to execute unauthorized code or commands via specially crafted CLI commands.
- CVE-2025-24471Medium
FortiOS versions 7.6.1 and below, and 7.4.7 and below, have an Improper Certificate Validation vulnerability. This may allow an EAP verified remote user to connect from FortiClient using a revoked certificate.
- CVE-2023-50176Medium
A session fixation vulnerability in Fortinet FortiOS 7.4.0 through 7.4.3, FortiOS 7.2.0 through 7.2.7, FortiOS 7.0.0 through 7.0.13 allows attacker to execute unauthorized code or commands via phishing SAML authentication link.
- CVE-2023-42790High
A stack-based buffer overflow vulnerability in Fortinet FortiOS, FortiProxy, and FortiSASE allows an attacker to execute unauthorized code or commands via specially crafted HTTP requests.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS