Fortinet
FortiOS vulnerabilities (CVE): affected branches, fixed releases, CISA KEV
Affected branches, fixed releases stated by the vendor and known exploitation for Fortinet FortiOS.
Sources last modified 30 Sept 2026 · Last verified by Patcharo: 1 Oct 2026 at 12:17 UTC
- 60
- CVEs tracked
- 13
- Critical
- 11
- CISA KEV
- 0
- With a fixed release
Versions by branch
Per branch: the newest release the vendor lists, what the vendor recommends and for whom, the support state and when Patcharo last verified each fact. Three facts read from the vendor's documents and shown apart: the newest release is not a recommendation.
21 branches shown
- 8.0Not collectedLatest public release
No release listed in the sources Patcharo reads
Vendor recommendationSupportSupported · until 21 Oct 2030Vulnerabilities0 CVEs - 7.6Not collectedLatest public release
No release listed in the sources Patcharo reads
Vendor recommendation7.6.6 · For 91 models
Technical Tip: Recommended release for FortiOS (as of June 2026) · Last verified 30 Sept 2026 at 21:18 UTC
SupportSupported · until 25 Jan 2030Vulnerabilities22 CVEs · 4 KEVnewest fix 7.6.7 - 7.4Not collectedLatest public release
No release listed in the sources Patcharo reads
Vendor recommendation7.4.11 · For 9 models
Technical Tip: Recommended release for FortiOS (as of June 2026) · Last verified 30 Sept 2026 at 21:18 UTC
SupportSupported · until 11 Nov 2028Vulnerabilities45 CVEs · 6 KEVnewest fix 7.4.11 - 7.2Not collectedLatest public release
No release listed in the sources Patcharo reads
Vendor recommendation7.2.11 · For 2 models
Technical Tip: Recommended release for FortiOS (as of June 2026) · Last verified 30 Sept 2026 at 21:18 UTC
7.2.13 · For 2 models
Technical Tip: Recommended release for FortiOS (as of June 2026) · Last verified 30 Sept 2026 at 21:18 UTC
SupportEnd of life · until 30 Sept 2026Vulnerabilities50 CVEs · 9 KEVnewest fix 7.2.13 - 7.0Not collectedLatest public release
No release listed in the sources Patcharo reads
Vendor recommendation7.0.19 · For 2 models
Technical Tip: Recommended release for FortiOS (as of June 2026) · Last verified 30 Sept 2026 at 21:18 UTC
SupportEnd of life · until 30 Sept 2025Vulnerabilities48 CVEs · 11 KEVnewest fix 7.0.19 - 6.4Not collectedLatest public release
No release listed in the sources Patcharo reads
Vendor recommendation6.4.16 · For 1 model
Technical Tip: Recommended release for FortiOS (as of June 2026) · Last verified 30 Sept 2026 at 21:18 UTC
SupportEnd of life · until 30 Sept 2024Vulnerabilities40 CVEs · 6 KEVnewest fix 6.4.16 - 6.2Not collectedLatest public release
No release listed in the sources Patcharo reads
Vendor recommendation6.2.17 · For 8 models
Technical Tip: Recommended release for FortiOS (as of June 2026) · Last verified 30 Sept 2026 at 21:18 UTC
SupportEnd of life · until 28 Sept 2023Vulnerabilities25 CVEs · 4 KEVnewest fix 6.2.17 - 6.0Not collectedLatest public release
No release listed in the sources Patcharo reads
Vendor recommendation6.0.18 · For 3 models
Technical Tip: Recommended release for FortiOS (as of June 2026) · Last verified 30 Sept 2026 at 21:18 UTC
SupportEnd of life · until 29 Sept 2022Vulnerabilities19 CVEs · 4 KEVnewest fix 6.0.18 - 5.6Not collectedLatest public release
No release listed in the sources Patcharo reads
Vendor recommendationSupportEnd of life · until 30 Sept 2021Vulnerabilities5 CVEs · 1 KEVnewest fix 5.6.13 - 5.4Not collectedLatest public release
No release listed in the sources Patcharo reads
Vendor recommendationSupportEnd of life · until 21 Jun 2020Vulnerabilities3 CVEs · 1 KEV - 5.2Not collectedLatest public release
No release listed in the sources Patcharo reads
Vendor recommendationSupportEnd of life · until 13 Dec 2018Vulnerabilities3 CVEs · 1 KEV - 5.0Not collectedLatest public release
No release listed in the sources Patcharo reads
Vendor recommendationSupportEnd of life · until 1 May 2017Vulnerabilities3 CVEs · 1 KEV - 4.3Not collectedLatest public release
No release listed in the sources Patcharo reads
Vendor recommendationSupportEnd of life · until 19 Mar 2014Vulnerabilities1 CVE - 4.2Not collectedLatest public release
No release listed in the sources Patcharo reads
Vendor recommendationSupportEnd of life · until 1 Apr 2013Vulnerabilities1 CVE - 4.1Not collectedLatest public release
No release listed in the sources Patcharo reads
Vendor recommendationSupportEnd of life · until 24 Aug 2012Vulnerabilities1 CVE - 4.0Not collectedLatest public release
No release listed in the sources Patcharo reads
Vendor recommendationSupportEnd of life · until 24 Feb 2012Vulnerabilities1 CVE - 3.7Not collectedLatest public release
No release listed in the sources Patcharo reads
Vendor recommendationSupportEnd of life · until 18 Jul 2011Vulnerabilities0 CVEs - 3.6Not collectedLatest public release
No release listed in the sources Patcharo reads
Vendor recommendationSupportEnd of life · until 4 Feb 2011Vulnerabilities0 CVEs - 3.5Not collectedLatest public release
No release listed in the sources Patcharo reads
Vendor recommendationSupportEnd of life · until 3 Jul 2010Vulnerabilities0 CVEs - 3.4Not collectedLatest public release
No release listed in the sources Patcharo reads
Vendor recommendationSupportEnd of life · until 29 Dec 2009Vulnerabilities0 CVEs - 3.3Not collectedLatest public release
No release listed in the sources Patcharo reads
Vendor recommendationSupportEnd of life · until 2 Oct 2009Vulnerabilities0 CVEs
Last successful check against the source. The content may be unchanged. Checked about every 6 hours (192 hours for a branch past its support); “page verified recently” means a successful check within the last 24 hours. Availability, recommendation and support are read from the vendor's documents and shown apart; a release Patcharo lists is not advice to install it.
Vulnerability history
Every CVE NVD attaches to FortiOS over the period, whatever its score: published records only, rejected identifiers kept apart. Counts are publication counts.
Last 10 years · 14 Nov 2016 – 14 Nov 2026 · Rolling calendar period, by publication date of the CVE record; both days included.
The history could not be read right now. The list below shows the analysed catalog only.
Verified history · History not collected yet: the counts above are not a measure.
Scores and statuses are the facts known today, not their history.
CVEs published over the period
14 Nov 2016 – 14 Nov 2026 · Newest first. A record analysed by Patcharo links to its page with affected and fixed releases; the others show NVD's facts.
The history could not be read right now. The list below shows the analysed catalog only.
Analysed vulnerabilities
- CVE-2026-71407Published: High8.1CVSS 3.1, HighNoEPSS0.42%
Fortinet FortiOS, Fortinet FortiProxy, Fortinet FortiPAM
- CVE-2025-53844Published: High8.8CVSS 3.1, HighNoEPSS0.56%
Fortinet FortiOS
- CVE-2025-53847Published: High8.8CVSS 3.1, HighNoEPSS0.28%
Fortinet FortiOS
- CVE-2025-68686Published: Medium5.9CVSS 3.1, MediumKEVDue 10 Aug 2026EPSS30%
Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
Fortinet FortiOS
- CVE-2025-64157Published: High7.2CVSS 3.1, HighNoEPSS1%
Fortinet FortiOS
- CVE-2026-22153Published: High8.1CVSS 3.1, HighNoEPSS0.71%
Fortinet FortiOS
- CVE-2026-24858Published: Critical9.8CVSS 3.1, CriticalKEVDue 30 Jan 2026EPSS86%
Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability
Fortinet FortiWeb, Fortinet FortiOS, Fortinet FortiAnalyzer
- CVE-2025-25249Published: Critical9.8CVSS 3.1, CriticalKEVDue 12 Sept 2026EPSS4%
Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability
Fortinet FortiOS, Fortinet FortiSwitchManager
- CVE-2025-59718Published: Critical9.8CVSS 3.1, CriticalKEVDue 23 Dec 2025EPSS68%
Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability
Fortinet FortiOS, Fortinet FortiProxy, Fortinet FortiSwitchManager
- CVE-2025-53843Published: High7.5CVSS 3.1, HighNoEPSS0.59%
Fortinet FortiOS
- CVE-2025-58413Published: High7.5CVSS 3.1, HighNoEPSS0.32%
Fortinet FortiOS, Fortinet FortiSASE
- CVE-2023-46718Published: High7.8CVSS 3.1, HighNoEPSS0.19%
Fortinet FortiOS, Fortinet FortiProxy
- CVE-2024-50571Published: High7.2CVSS 3.1, HighNoEPSS0.54%
Fortinet FortiManager, Fortinet FortiOS, Fortinet FortiAnalyzer
- CVE-2025-22258Published: High7.2CVSS 3.1, HighNoEPSS0.56%
Fortinet FortiOS, Fortinet FortiProxy, Fortinet FortiPAM
- CVE-2025-25253Published: High7.5CVSS 3.1, HighNoEPSS0.11%
Fortinet FortiProxy, Fortinet FortiOS, Fortinet FortiPAM
- CVE-2025-57740Published: High8.8CVSS 3.1, HighNoEPSS0.68%
Fortinet FortiProxy, Fortinet FortiOS, Fortinet FortiPAM
- CVE-2024-26009Published: High8.1CVSS 3.1, HighNoEPSS0.59%
Fortinet FortiProxy, Fortinet FortiOS, Fortinet FortiPAM
- CVE-2023-45584Published: High7.2CVSS 3.1, HighNoEPSS0.59%
Fortinet FortiProxy, Fortinet FortiOS, Fortinet FortiPAM
- CVE-2025-53744Published: High7.2CVSS 3.1, HighNoEPSS0.63%
Fortinet FortiOS
- CVE-2024-52965Published: High7.2CVSS 3.1, HighNoEPSS0.28%
Fortinet FortiOS, Fortinet FortiProxy
- CVE-2025-22254Published: High7.2CVSS 3.1, HighNoEPSS0.85%
Fortinet FortiOS, Fortinet FortiProxy, Fortinet FortiWeb
- CVE-2025-22252Published: High7.2CVSS 3.1, HighNoEPSS0.94%
Fortinet FortiProxy, Fortinet FortiOS, Fortinet FortiSwitchManager
- CVE-2024-50565Published: High7.5CVSS 3.1, HighNoEPSS0.39%
Fortinet FortiOS, Fortinet FortiWeb, Fortinet FortiAnalyzer
- CVE-2024-26013Published: High7.5CVSS 3.1, HighNoEPSS0.50%
Fortinet FortiProxy, Fortinet FortiManager, Fortinet FortiOS
- CVE-2023-37930Published: High8.8CVSS 3.1, HighNoEPSS0.63%
Fortinet FortiProxy, Fortinet FortiOS
- CVE-2023-25610Published: Critical9.8CVSS 3.1, CriticalNoEPSS18%
Fortinet FortiAnalyzer, Fortinet FortiProxy, Fortinet FortiOS
- CVE-2024-45324Published: High7.2CVSS 3.1, HighNoEPSS0.72%
Fortinet FortiWeb, Fortinet FortiProxy, Fortinet FortiOS
- CVE-2025-24472Published: High8.1CVSS 3.1, HighKEVRansomwareDue 8 Apr 2025EPSS7%
Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
Fortinet FortiOS, Fortinet FortiProxy
- CVE-2024-35279Published: High8.1CVSS 3.1, HighNoEPSS1%
Fortinet FortiOS
- CVE-2024-40591Published: High7.2CVSS 3.1, HighNoEPSS0.62%
Fortinet FortiOS
- CVE-2024-48886Published: Critical9.8CVSS 3.1, CriticalNoEPSS0.48%
Fortinet FortiOS, Fortinet FortiProxy
- CVE-2024-48884Published: Critical9.1CVSS 3.1, CriticalNoEPSS15%
Fortinet FortiManager, Fortinet FortiProxy, Fortinet FortiOS
- CVE-2024-46668Published: High7.5CVSS 3.1, HighNoEPSS1.00%
Fortinet FortiOS
- CVE-2024-46670Published: High7.5CVSS 3.1, HighNoEPSS0.63%
Fortinet FortiOS, Fortinet FortiProxy, Fortinet FortiPAM
- CVE-2024-55591Published: Critical9.8CVSS 3.1, CriticalKEVRansomwareDue 21 Jan 2025EPSS94%
Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
Fortinet FortiOS, Fortinet FortiProxy
- CVE-2020-12820Published: High8.8CVSS 3.1, HighNoEPSS0.89%
Fortinet FortiOS
- CVE-2020-12819Published: High7.5CVSS 3.1, HighNoEPSS0.79%
Fortinet FortiOS
- CVE-2024-26011Published: Critical9.8CVSS 3.1, CriticalNoEPSS0.60%
Fortinet FortiManager, Fortinet FortiProxy, Fortinet FortiOS
- CVE-2023-50176Published: High8.8CVSS 3.1, HighNoEPSS0.40%
Fortinet FortiOS
- CVE-2022-45862Published: High8.8CVSS 3.1, HighNoEPSS0.44%
Fortinet FortiProxy, Fortinet FortiOS, Fortinet FortiPAM
- CVE-2024-26010Published: High7.5CVSS 3.1, HighNoEPSS0.79%
Fortinet FortiOS, Fortinet FortiProxy, Fortinet FortiPAM
- CVE-2023-46720Published: High7.8CVSS 3.1, HighNoEPSS0.28%
Fortinet FortiOS
- CVE-2024-23110Published: High7.8CVSS 3.1, HighNoEPSS0.28%
Fortinet FortiOS
- CVE-2023-45583Published: High7.2CVSS 3.1, HighNoEPSS0.66%
Fortinet FortiOS, Fortinet FortiProxy, Fortinet FortiSwitchManager
- CVE-2023-46714Published: High7.2CVSS 3.1, HighNoEPSS1%
Fortinet FortiOS
- CVE-2023-44247Published: High7.2CVSS 3.1, HighNoEPSS1%
Fortinet FortiOS
- CVE-2024-26007Published: High7.5CVSS 3.1, HighNoEPSS1%
Fortinet FortiOS
- CVE-2023-41677Published: High8.8CVSS 3.1, HighNoEPSS0.75%
Fortinet FortiOS, Fortinet FortiProxy
- CVE-2024-23662Published: High7.5CVSS 3.1, HighNoEPSS0.70%
Fortinet FortiOS
- CVE-2023-46717Published: High8.8CVSS 3.1, HighNoEPSS0.64%
Fortinet FortiOS
- CVE-2023-42789Published: Critical9.8CVSS 3.1, CriticalNoEPSS3%
Fortinet FortiProxy, Fortinet FortiOS, Fortinet FortiSASE
- CVE-2023-42790Published: High8.1CVSS 3.1, HighNoEPSS1%
Fortinet FortiProxy, Fortinet FortiOS
- CVE-2023-29180Published: High7.5CVSS 3.1, HighNoEPSS3%
Fortinet FortiOS, Fortinet FortiProxy
- CVE-2023-29181Published: High8.8CVSS 3.1, HighNoEPSS0.72%
Fortinet FortiOS, Fortinet FortiProxy, Fortinet FortiPAM
- CVE-2024-23113Published: Critical9.8CVSS 3.1, CriticalKEVDue 30 Oct 2024EPSS62%
Fortinet Multiple Products Format String Vulnerability
Fortinet FortiOS, Fortinet FortiProxy, Fortinet FortiSwitchManager
- CVE-2024-21762Published: Critical9.8CVSS 3.1, CriticalKEVRansomwareDue 16 Feb 2024EPSS83%
Fortinet FortiOS Out-of-Bound Write Vulnerability
Fortinet FortiProxy, Fortinet FortiOS
- CVE-2023-44250Published: High8.8CVSS 3.1, HighNoEPSS0.90%
Fortinet FortiOS, Fortinet FortiProxy
- CVE-2023-27997Published: Critical9.8CVSS 3.1, CriticalKEVRansomwareDue 4 Jul 2023EPSS86%
Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability
Fortinet FortiProxy, Fortinet FortiOS, Fortinet FortiOS-6K7K
- CVE-2022-41328Published: High7.1CVSS 3.1, HighKEVDue 4 Apr 2023EPSS11%
Fortinet FortiOS Path Traversal Vulnerability
Fortinet FortiOS
- CVE-2022-42475Published: Critical9.8CVSS 3.1, CriticalKEVRansomwareDue 3 Jan 2023EPSS99%
Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability
Fortinet FortiProxy, Fortinet FortiOS
Vendor recommendation
The vendor's own statement about what to run, with its date and source. Separate from vulnerabilities and from support status: being behind a recommendation is not a vulnerability, and a supported release is not necessarily the recommended one.
Recommended release per model
The vendor states one recommended release per hardware model (118 models); models are grouped by recommended release.
Vendor wording: “Recommended Release Version” · vendor statement dated 1 Jun 2026
- 7.6.6
- FortiGate-40F, FortiGate-40F-3G4G, FortiGate-50G/51G and variants, FortiGate-60F, FortiGate-61F, FortiGate-70F, FortiGate-70G/71G and variants, FortiGate-71F, FortiGate-80F, FortiGate-81F, FortiGate-90G, FortiGate-91G, FortiGate-100F, FortiGate-101F, FortiGate-120G, FortiGate-121G, FortiGate-200E, FortiGate-200F, FortiGate-200G/201G, FortiGate-201E, FortiGate-201F, FortiGate-300E, FortiGate-301E, FortiGate-400E, FortiGate-400E-BYPASS, FortiGate-400F, FortiGate-401E, FortiGate-401F, FortiGate-500E, FortiGate-501E, FortiGate-600E, FortiGate-600F, FortiGate-601E, FortiGate-601F, FortiGate-800D, FortiGate-900D, FortiGate-900G, FortiGate-901G, FortiGate-1000D, FortiGate-1000F, FortiGate-1001F, FortiGate-1100E, FortiGate-1101E, FortiGate-1800F, FortiGate-1801F, FortiGate-2000E, FortiGate-2200E, FortiGate-2201E, FortiGate-2500E, FortiGate-2600F, FortiGate-2601F, FortiGate-3000D, FortiGate-3000F, FortiGate-3001F, FortiGate-3100D, FortiGate-3200D, FortiGate-3200F, FortiGate-3201F, FortiGate-3300E, FortiGate-3301E, FortiGate-3400E, FortiGate-3401E, FortiGate-3500F, FortiGate-3501F, FortiGate-3600E, FortiGate-3601E, FortiGate-3700D, FortiGate-3700F, FortiGate-3701F, FortiGate-3960E, FortiGate-3980E, FortiGate-4200F, FortiGate-4201F, FortiGate-4400F, FortiGate-4401F, FortiGate-4800F, FortiGate-4801F, FortiGate-5001E, FortiGate-5001E1, FortiGate-6000F / 7000E / 7000F, FortiGate-VM64 - all versions, FortiGateRugged-60F, FortiGateRugged-60F-3G4G, FortiGateRugged-70F, FortiGateRugged-70F-3G4G, FortiWiFi-40F, FortiWiFi-40F-3G4G, FortiWiFi-50G/51G and variants, FortiWiFi-60F, FortiWiFi-61F, FortiWiFi-70G/71G and variants
- 7.4.11
- FortiGate-30G, FortiGate-31G, FortiGate-60E, FortiGate-80E, FortiGate-81E, FortiGate-90E, FortiGate-140E, FortiWiFi-30G, FortiWifi-60E
- 7.2.13
- FortiGate-1500D, FortiGate-1500DT
- 7.2.11
- FortiGate-100E, FortiGate-101E
- 7.0.19
- FortiGate-1200D, FortiGate-3800D
- 6.4.16
- FortiGate-5001D
- 6.2.17
- FortiGate-30E, FortiGate-50E, FortiGate-51E, FortiGate-52E, FortiGateRugged-35D, FortiWiFi-30E, FortiWiFi-50E, FortiWiFi-51E
- 6.0.18
- FortiGate-98D-POE, FortiGate-240D, FortiGate-280D
Source: Technical Tip: Recommended release for FortiOS (as of June 2026)last verified by Patcharo 30 Sept 2026 at 21:18 UTC
CERT-FR
Advisories and alerts of the French national CERT referencing the CVEs of this product.
- Advisory (AVI)CERTFR-2026-AVI-1015Multiple vulnerabilities in Fortinet productsPublished 13 Aug 2026
- Advisory (AVI)CERTFR-2026-AVI-0575Multiple vulnerabilities in Fortinet productsPublished 13 May 2026
- Advisory (AVI)CERTFR-2026-AVI-0440Multiple vulnerabilities in Fortinet productsPublished 15 Apr 2026
- Advisory (AVI)CERTFR-2026-AVI-0147Multiple vulnerabilities in Fortinet productsPublished 11 Feb 2026
- Advisory (AVI)CERTFR-2026-AVI-0097Vulnerability in Fortinet productsPublished 28 Jan 2026
- Advisory (AVI)CERTFR-2026-AVI-0035Multiple vulnerabilities in Fortinet productsPublished 14 Jan 2026
- Advisory (AVI)CERTFR-2025-AVI-1084Multiple vulnerabilities in Fortinet productsPublished 10 Dec 2025
- Advisory (AVI)CERTFR-2025-AVI-1023Multiple vulnerabilities in Fortinet productsPublished 19 Nov 2025
- Advisory (AVI)CERTFR-2025-AVI-0871Multiple vulnerabilities in Fortinet productsPublished 15 Oct 2025
- Advisory (AVI)CERTFR-2025-AVI-0679Multiple vulnerabilities in Fortinet productsPublished 13 Aug 2025
Some titles in this list are machine-translated by artificial intelligence (Mistral AI) from the source texts; each record shows the original.