Fortinet

FortiWeb vulnerabilities (CVE): affected branches, fixed releases, CISA KEV

Affected branches, fixed releases stated by the vendor and known exploitation for Fortinet FortiWeb.

Sources last modified 17 Jun 2026 · Last verified by Patcharo: 1 Oct 2026 at 09:33 UTC

8
CVEs tracked: 4
Critical: 4
CISA KEV: 0
With a fixed release

Versions by branch

Per branch: the newest release the vendor lists, what the vendor recommends and for whom, the support state and when Patcharo last verified each fact. Three facts read from the vendor's documents and shown apart: the newest release is not a recommendation.

Filter the branches

Branch or model

28 branches shown

8.0Not collected
Latest public release
No release listed in the sources Patcharo reads
Vendor recommendation
No public recommendation source for this vendor
SupportSupported · until 28 Jan 2030
Vulnerabilities3 CVEs · 3 KEVnewest fix 8.0.4
Last verified
Not collected
7.6Not collected
Latest public release
No release listed in the sources Patcharo reads
Vendor recommendation
No public recommendation source for this vendor
SupportSupported · until 25 Dec 2028
Vulnerabilities6 CVEs · 4 KEVnewest fix 7.6.7
Last verified
Not collected
7.4Not collected
Latest public release
No release listed in the sources Patcharo reads
Vendor recommendation
No public recommendation source for this vendor
SupportSupported · until 25 Jan 2028
Vulnerabilities7 CVEs · 4 KEVnewest fix 7.4.12
Last verified
Not collected
7.2Not collected
Latest public release
No release listed in the sources Patcharo reads
Vendor recommendation
No public recommendation source for this vendor
SupportApproaching end of support · until 16 Jun 2027
Vulnerabilities6 CVEs · 3 KEVnewest fix 7.2.12
Last verified
Not collected
7.0Not collected
Latest public release
No release listed in the sources Patcharo reads
Vendor recommendation
No public recommendation source for this vendor
SupportEnd of life · until 19 Jul 2026
Vulnerabilities6 CVEs · 3 KEVnewest fix 7.0.12
Last verified
Not collected
6.4Not collected
Latest public release
No release listed in the sources Patcharo reads
Vendor recommendation
No public recommendation source for this vendor
SupportEnd of life · until 1 Oct 2023
Vulnerabilities1 CVEnewest fix 6.4.3
Last verified
Not collected
6.3Not collected
Latest public release
No release listed in the sources Patcharo reads
Vendor recommendation
No public recommendation source for this vendor
SupportEnd of life · until 21 Jul 2024
Vulnerabilities1 CVEnewest fix 6.3.23
Last verified
Not collected
6.2Not collected
Latest public release
No release listed in the sources Patcharo reads
Vendor recommendation
No public recommendation source for this vendor
SupportEnd of life · until 30 Mar 2024
Vulnerabilities1 CVEnewest fix 6.2.8
Last verified
Not collected
6.1Not collected
Latest public release
No release listed in the sources Patcharo reads
Vendor recommendation
No public recommendation source for this vendor
SupportEnd of life · until 27 Sept 2023
Vulnerabilities1 CVEnewest fix 6.1.4
Last verified
Not collected
6.0Not collected
Latest public release
No release listed in the sources Patcharo reads
Vendor recommendation
No public recommendation source for this vendor
SupportEnd of life · until 23 Nov 2022
Vulnerabilities0 CVEs
Last verified
Not collected
5.9Not collected
Latest public release
No release listed in the sources Patcharo reads
Vendor recommendation
No public recommendation source for this vendor
SupportEnd of life · until 20 Sept 2022
Vulnerabilities0 CVEs
Last verified
Not collected
5.8Not collected
Latest public release
No release listed in the sources Patcharo reads
Vendor recommendation
No public recommendation source for this vendor
SupportEnd of life · until 27 Oct 2021
Vulnerabilities0 CVEs
Last verified
Not collected
5.7Not collected
Latest public release
No release listed in the sources Patcharo reads
Vendor recommendation
No public recommendation source for this vendor
SupportEnd of life · until 18 Jul 2021
Vulnerabilities0 CVEs
Last verified
Not collected
5.6Not collected
Latest public release
No release listed in the sources Patcharo reads
Vendor recommendation
No public recommendation source for this vendor
SupportEnd of life · until 26 Sept 2019
Vulnerabilities0 CVEs
Last verified
Not collected
5.5Not collected
Latest public release
No release listed in the sources Patcharo reads
Vendor recommendation
No public recommendation source for this vendor
SupportEnd of life · until 15 Dec 2018
Vulnerabilities0 CVEs
Last verified
Not collected
5.4Not collected
Latest public release
No release listed in the sources Patcharo reads
Vendor recommendation
No public recommendation source for this vendor
SupportEnd of life · until 14 Aug 2018
Vulnerabilities0 CVEs
Last verified
Not collected
5.3Not collected
Latest public release
No release listed in the sources Patcharo reads
Vendor recommendation
No public recommendation source for this vendor
SupportEnd of life · until 2 Mar 2018
Vulnerabilities0 CVEs
Last verified
Not collected
5.2Not collected
Latest public release
No release listed in the sources Patcharo reads
Vendor recommendation
No public recommendation source for this vendor
SupportEnd of life · until 1 Nov 2017
Vulnerabilities0 CVEs
Last verified
Not collected
5.1Not collected
Latest public release
No release listed in the sources Patcharo reads
Vendor recommendation
No public recommendation source for this vendor
SupportEnd of life · until 20 Jul 2017
Vulnerabilities0 CVEs
Last verified
Not collected
5.0Not collected
Latest public release
No release listed in the sources Patcharo reads
Vendor recommendation
No public recommendation source for this vendor
SupportEnd of life · until 17 Nov 2017
Vulnerabilities0 CVEs
Last verified
Not collected
4.4Not collected
Latest public release
No release listed in the sources Patcharo reads
Vendor recommendation
No public recommendation source for this vendor
SupportEnd of life · until 22 Jun 2015
Vulnerabilities0 CVEs
Last verified
Not collected
4.3Not collected
Latest public release
No release listed in the sources Patcharo reads
Vendor recommendation
No public recommendation source for this vendor
SupportEnd of life · until 1 Aug 2014
Vulnerabilities0 CVEs
Last verified
Not collected
4.2Not collected
Latest public release
No release listed in the sources Patcharo reads
Vendor recommendation
No public recommendation source for this vendor
SupportEnd of life · until 1 Feb 2014
Vulnerabilities0 CVEs
Last verified
Not collected
4.1Not collected
Latest public release
No release listed in the sources Patcharo reads
Vendor recommendation
No public recommendation source for this vendor
SupportEnd of life · until 3 Aug 2013
Vulnerabilities0 CVEs
Last verified
Not collected
4.0Not collected
Latest public release
No release listed in the sources Patcharo reads
Vendor recommendation
No public recommendation source for this vendor
SupportEnd of life · until 12 Mar 2013
Vulnerabilities0 CVEs
Last verified
Not collected
3.3Not collected
Latest public release
No release listed in the sources Patcharo reads
Vendor recommendation
No public recommendation source for this vendor
SupportEnd of life · until 3 Sept 2012
Vulnerabilities0 CVEs
Last verified
Not collected
3.2Not collected
Latest public release
No release listed in the sources Patcharo reads
Vendor recommendation
No public recommendation source for this vendor
SupportEnd of life · until 4 Jun 2012
Vulnerabilities0 CVEs
Last verified
Not collected
3.1Not collected
Latest public release
No release listed in the sources Patcharo reads
Vendor recommendation
No public recommendation source for this vendor
SupportEnd of life · until 20 Apr 2012
Vulnerabilities0 CVEs
Last verified
Not collected

Last successful check against the source. The content may be unchanged. Checked about every 6 hours (192 hours for a branch past its support); “page verified recently” means a successful check within the last 24 hours. Availability, recommendation and support are read from the vendor's documents and shown apart; a release Patcharo lists is not advice to install it.

Vulnerability history

Every CVE NVD attaches to FortiWeb over the period, whatever its score: published records only, rejected identifiers kept apart. Counts are publication counts.

Last 12 months · 14 Nov 2025 – 14 Nov 2026 · Rolling calendar period, by publication date of the CVE record; both days included.

The history could not be read right now. The list below shows the analysed catalog only.

Verified history · History not collected yet: the counts above are not a measure.

Scores and statuses are the facts known today, not their history.

CVEs published over the period

14 Nov 2025 – 14 Nov 2026 · Newest first. A record analysed by Patcharo links to its page with affected and fixed releases; the others show NVD's facts.

The history could not be read right now. The list below shows the analysed catalog only.

Analysed vulnerabilities

CVE-2026-24858Published: 27 Jan 2026
Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability
Fortinet FortiWeb, Fortinet FortiOS, Fortinet FortiAnalyzer
Critical9.8CVSS 3.1, CriticalKEVDue 30 Jan 2026EPSS86%
CVE-2025-58034Published: 18 Nov 2025
Fortinet FortiWeb OS Command Injection Vulnerability
Fortinet FortiWeb
High7.2CVSS 3.1, HighKEVDue 25 Nov 2025EPSS56%
CVE-2025-64446Published: 14 Nov 2025
Fortinet FortiWeb Path Traversal Vulnerability
Fortinet FortiWeb
Critical9.8CVSS 3.1, CriticalKEVDue 21 Nov 2025EPSS92%
CVE-2025-25257Published: 17 Jul 2025
Fortinet FortiWeb SQL Injection Vulnerability
Fortinet FortiWeb
Critical9.8CVSS 3.1, CriticalKEVDue 8 Aug 2025EPSS100%
CVE-2025-22254Published: 10 Jun 2025
An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.…
Fortinet FortiOS, Fortinet FortiProxy, Fortinet FortiWeb
High7.2CVSS 3.1, HighNoEPSS0.85%
CVE-2024-50565Published: 8 Apr 2025
A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet For…
Fortinet FortiOS, Fortinet FortiWeb, Fortinet FortiAnalyzer
High7.5CVSS 3.1, HighNoEPSS0.39%
CVE-2023-25610Published: 24 Mar 2025
A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS ve…
Fortinet FortiAnalyzer, Fortinet FortiProxy, Fortinet FortiOS
Critical9.8CVSS 3.1, CriticalNoEPSS18%
CVE-2024-45324Published: 11 Mar 2025
A use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.0 through 7.4.4, …
Fortinet FortiWeb, Fortinet FortiProxy, Fortinet FortiOS
High7.2CVSS 3.1, HighNoEPSS0.72%

Vendor recommendation

The vendor's own statement about what to run, with its date and source. Separate from vulnerabilities and from support status: being behind a recommendation is not a vulnerability, and a supported release is not necessarily the recommended one.

Fortinet publishes no recommended-release page Patcharo can read. The fixed releases on this site come from the security advisories only; nothing is inferred from version numbers.

CERT-FR

Advisories and alerts of the French national CERT referencing the CVEs of this product.

Advisory (AVI)CERTFR-2026-AVI-0097Vulnerability in Fortinet productsPublished 28 Jan 2026
Advisory (AVI)CERTFR-2025-AVI-1023Multiple vulnerabilities in Fortinet productsPublished 19 Nov 2025
Advisory (AVI)CERTFR-2025-AVI-1014Vulnerability in Fortinet FortiWebPublished 14 Nov 2025
Advisory (AVI)CERTFR-2025-AVI-0575Multiple vulnerabilities in Fortinet productsPublished 9 Jul 2025
Advisory (AVI)CERTFR-2025-AVI-0496Multiple vulnerabilities in Fortinet productsPublished 11 Jun 2025
Advisory (AVI)CERTFR-2025-AVI-0293Multiple vulnerabilities in Fortinet productsPublished 9 Apr 2025
Advisory (AVI)CERTFR-2025-AVI-0197Multiple vulnerabilities in Fortinet productsPublished 12 Mar 2025

Some titles in this list are machine-translated by artificial intelligence (Mistral AI) from the source texts; each record shows the original.

Official sources

Fortinet PSIRT Advisories