Fortinet · week of 12 Oct 2026
Fortinet security note
Records on this stack that changed between 12 Oct 2026 and the following Monday. Versions come from the stored ranges. A quiet week is not proof the stack is clear.
What changed
CVE-2025-25250 — Check this week
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2 all versions
Affected: 7.0.0 ≤7.0.19
CVE-2025-24471 — Check this week
An Improper Certificate Validation vulnerability [CWE-295] in FortiOS version 7.6.1 and below, version 7.4.7 and below may allow an EAP verified remote user to connect from FortiCl
Affected: 7.6.0 ≤7.6.1
CVE-2024-55599 — Check this week
An Improperly Implemented Security Check for Standard vulnerability [CWE-358] in FortiOS version 7.6.0, version 7.4.7 and below, 7.0 all versions, 6.4 all versions and FortiProxy v
Affected: 7.4.0 ≤7.4.7
CVE-2024-50562 — Check if you run it
An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions m
Affected: 7.4.0 ≤7.4.5
CVE-2022-0778 — Check this week
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli.
Affected: 10.0, 11.0, 9.0
What we still do not know
CVE-2025-64446 — Patch now
Fortinet FortiWeb Path Traversal Vulnerability
No version range is stored, so an installed version cannot be checked.
CVE-2025-61624 — Patch now
Fortinet Multiple Products Path Traversal Vulnerability
No version range is stored, so an installed version cannot be checked.
CVE-2025-62631 — Patch now
Fortinet FortiOS Insufficient Session Expiration
No version range is stored, so an installed version cannot be checked.
CVE-2025-57739 — Check if you run it
SQL command injection in webmail
No version range is stored, so an installed version cannot be checked.
CVE-2026-84393 — Check if you run it
ZTNA Portal Improper Certificate Validation
No version range is stored, so an installed version cannot be checked.
CVE-2026-84392 — Check if you run it
Null Pointer Dereference in Log Report
No version range is stored, so an installed version cannot be checked.
CVE-2026-71408 — Check if you run it
UI DoS attack
No version range is stored, so an installed version cannot be checked.
CVE-2026-71407 — Check if you run it
Stack buffer overflow in WAD
No version range is stored, so an installed version cannot be checked.
Share this note
Fortinet security note, week of 12 Oct 2026: 5 records have a version a customer can check, and 8 still do not. https://zerodayfindings.com/technologies/fortinet/notes/2026-W42