Fortinet security vulnerabilities
Fortinet PSIRT and related public records for Forti products with exploitation signals when available.
Built for Network administrators.
307 public records · 45 security-fix timeline events.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 2
- High 8
- Medium 5
- Low 3
2026-07-2118 issues2026-10-18
Known exploited
View all known exploited- Critical9.8Fortinet FortiWeb SQL Injection VulnerabilityPatch nowKEVEPSS 99.81%Jul 11, 2025
- High8.8Linux Kernel Write-what-where ConditionPatch nowKEVEPSS 94.19%May 8, 2026
- Critical9.8Fortinet FortiClient EMS SQL Injection VulnerabilityPatch nowKEVEPSS 93.87%Feb 6, 2026
- Critical9.8Fortinet FortiWeb Path Traversal VulnerabilityPatch nowKEVEPSS 91.97%Oct 6, 2025
- Critical9.8Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel VulnerabilityPatch nowKEVEPSS 85.80%Jan 27, 2026
- Critical9.8Fortinet FortiSandbox OS Command Injection VulnerabilityPatch nowKEVEPSS 76.11%Jun 9, 2026
- Critical9.8Fortinet Multiple Products Improper Verification of Cryptographic Signature VulnerabilityPatch nowKEVEPSS 68.29%Dec 9, 2025
- High7.2Fortinet FortiWeb OS Command Injection VulnerabilityPatch nowKEVEPSS 55.58%Nov 18, 2025
Recently published
Browse catalog- Critical9.8Arbitrary file write in grpc phQueryMasterCheck if you run itEPSS 0.43%Oct 13, 2026
- High8.8SQL command injection in webmailCheck if you run itEPSS 0.30%Oct 13, 2026
- High7.3ZDI-26-771: Fortinet FortiSandbox login_user_profile Hard-Coded Credentials Authentication Bypass VulnerabilityOpen the advisoryOct 13, 2026
- Medium6.1arbitrary command execution in fgfmsd daemonCheck if you run itEPSS 0.71%Oct 13, 2026
- Medium5.3A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions, FortiSandbox ClouCheck if you run itEPSS 0.24%Oct 13, 2026
- Medium4.9An Uncaught Exception vulnerability [CWE-248] vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions may allowCheck if you run itEPSS 0.28%Oct 13, 2026
- Critical9.8Fortinet FortiMail Path Traversal VulnerabilityPatch nowKEVEPSS 2.20%Oct 1, 2026
- High8.1ZTNA Portal Improper Certificate ValidationCheck if you run itEPSS 0.28%Sep 8, 2026
- High7.2ZDI-26-645: Fortinet FortiSandbox write_remote_backup_to_crontab cronValue Command Injection Remote Code Execution VulnerabilityCheck if you run itEPSS 1.40%Sep 8, 2026
- High8.1Stack buffer overflow in WADCheck if you run itEPSS 0.51%Aug 12, 2026