Skip to content
Patcharo

Fortinet vulnerabilities: CVE, KEV, fixed releases

Patcharo tracks 106 vulnerabilities affecting Fortinet products: 29 critical, 29 known exploited (CISA KEV), 0 with a fixed release stated by the vendor. Last source modification: 10 Sept 2026.

Last verified by Patcharo: 30 Sept 2026 at 12:52 UTC

Products covered

Each product has its own page with affected branches and fixed releases.

Latest vulnerabilities

Newest source publication first.

All Fortinet CVEs

Known exploited (CISA KEV)

Vulnerabilities CISA lists as exploited, with the federal remediation due date.

  • CVE-2025-25249Fortinet Multiple Products Heap-based Buffer Overflow VulnerabilityDue 12 Sept 2026
  • CVE-2025-68686Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor VulnerabilityDue 10 Aug 2026
  • CVE-2026-25089Fortinet FortiSandbox OS Command Injection VulnerabilityDue 19 Jul 2026
  • CVE-2026-39808Fortinet FortiSandbox OS Command Injection VulnerabilityDue 19 Jul 2026
  • CVE-2026-21643Fortinet FortiClient EMS SQL Injection VulnerabilityDue 16 Apr 2026
  • CVE-2026-35616Fortinet FortiClient EMS Improper Access Control VulnerabilityDue 9 Apr 2026
  • CVE-2026-24858Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel VulnerabilityDue 30 Jan 2026
  • CVE-2025-59718Fortinet Multiple Products Improper Verification of Cryptographic Signature VulnerabilityDue 23 Dec 2025
  • CVE-2025-58034Fortinet FortiWeb OS Command Injection VulnerabilityDue 25 Nov 2025
  • CVE-2025-64446Fortinet FortiWeb Path Traversal VulnerabilityDue 21 Nov 2025
Known exploited vulnerabilities (CISA KEV)

Official sources