Fortinet: actively exploited vulnerabilities

Affected products

• FortiOS9
• Multiple Products6
• FortiOS and FortiProxy4
• FortiClient EMS3
• FortiWeb3
• FortiSandbox2
• FortiMail1
• FortiManager1
• FortiOS and FortiADC1
• FortiOS and FortiProxy SSL-VPN1

Our analyses

CybersecurityAlert level 4 of 5: Priority

FortiMail critical flaw exploited before a patch was available (CVE-2026-104286)

Fortinet warns of a FortiMail flaw rated 9.8/10 that was exploited before any patch existed. Fixed versions are now available on all maintained branches. Here are the affected branches, the workaround to apply and the indicators of compromise.

Oct 11, 20262 min read

CERT-FR alerts and notices

Recent CERT-FR publications naming this vendor (alerts: immediate threat; notices: patches released). In French.

1. CERTFR-2026-AVI-1257Oct 2

   Vulnérabilité dans Fortinet FortiMail (02 octobre 2026)

2. CERTFR-2025-ALE-006May 13 2025

   Vulnérabilité dans les produits Fortinet (13 mai 2025)

3. CERTFR-2025-ALE-004Apr 11 2025

   Activités de post-exploitation dans Fortinet FortiGate (11 avril 2025)

4. CERTFR-2025-ALE-002Jan 14 2025

   [MàJ] Vulnérabilité dans les produits Fortinet (14 janvier 2025)

5. CERTFR-2024-ALE-014Oct 23 2024

   [MàJ] Multiples vulnérabilités dans Fortinet FortiManager (23 octobre 2024)

6. CERTFR-2024-ALE-004Feb 9 2024

   [MàJ] Vulnérabilité dans Fortinet FortiOS (09 février 2024)

All exploited vulnerabilities

CISA KEV catalog, newest first: each entry corresponds to observed exploitation.

2026 8 vulnerabilities

1. CVE-2026-104286added Oct 1

   Fortinet FortiMail Path Traversal Vulnerability

   Our article: FortiMail critical flaw exploited before a patch was available (CVE-2026-104286)

   NVD entryCISA catalog

2. CVE-2025-25249added Sep 9

   Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability

   NVD entryCISA catalog

3. CVE-2025-68686added Jul 27

   Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

   NVD entryCISA catalog

4. CVE-2026-39808added Jul 16

   Fortinet FortiSandbox OS Command Injection Vulnerability

   NVD entryCISA catalog

5. CVE-2026-25089added Jul 16

   Fortinet FortiSandbox OS Command Injection Vulnerability

   NVD entryCISA catalog

6. CVE-2026-21643added Apr 13

   Fortinet FortiClient EMS SQL Injection Vulnerability

   NVD entryCISA catalog

7. CVE-2026-35616added Apr 6

   Fortinet FortiClient EMS Improper Access Control Vulnerability

   NVD entryCISA catalog

8. CVE-2026-24858added Jan 27

   Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability

   NVD entryCISA catalog

2025 8 vulnerabilities

1. CVE-2025-59718added Dec 16 2025

   Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability

   NVD entryCISA catalog

2. CVE-2025-58034added Nov 18 2025

   Fortinet FortiWeb OS Command Injection Vulnerability

   NVD entryCISA catalog

3. CVE-2025-64446added Nov 14 2025

   Fortinet FortiWeb Path Traversal Vulnerability

   NVD entryCISA catalog

4. CVE-2025-25257added Jul 18 2025

   Fortinet FortiWeb SQL Injection Vulnerability

   NVD entryCISA catalog

5. CVE-2019-6693Used by ransomwareadded Jun 25 2025

   Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability

   NVD entryCISA catalog

6. CVE-2025-32756added May 14 2025

   Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability

   NVD entryCISA catalog

7. CVE-2025-24472Used by ransomwareadded Mar 18 2025

   Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

   NVD entryCISA catalog

8. CVE-2024-55591Used by ransomwareadded Jan 14 2025

   Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

   NVD entryCISA catalog

2024 4 vulnerabilities

1. CVE-2024-47575added Oct 23 2024

   Fortinet FortiManager Missing Authentication Vulnerability

   NVD entryCISA catalog

2. CVE-2024-23113added Oct 9 2024

   Fortinet Multiple Products Format String Vulnerability

   NVD entryCISA catalog

3. CVE-2023-48788Used by ransomwareadded Mar 25 2024

   Fortinet FortiClient EMS SQL Injection Vulnerability

   NVD entryCISA catalog

4. CVE-2024-21762Used by ransomwareadded Feb 9 2024

   Fortinet FortiOS Out-of-Bound Write Vulnerability

   NVD entryCISA catalog

2023 2 vulnerabilities

1. CVE-2023-27997Used by ransomwareadded Jun 13 2023

   Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability

   NVD entryCISA catalog

2. CVE-2022-41328added Mar 14 2023

   Fortinet FortiOS Path Traversal Vulnerability

   NVD entryCISA catalog

2022 5 vulnerabilities

1. CVE-2022-42475Used by ransomwareadded Dec 13 2022

   Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability

   NVD entryCISA catalog

2. CVE-2022-40684Used by ransomwareadded Oct 11 2022

   Fortinet Multiple Products Authentication Bypass Vulnerability

   NVD entryCISA catalog

3. CVE-2018-13374Used by ransomwareadded Sep 8 2022

   Fortinet FortiOS and FortiADC Improper Access Control Vulnerability

   NVD entryCISA catalog

4. CVE-2018-13383Used by ransomwareadded Jan 10 2022

   Fortinet FortiOS and FortiProxy Out-of-bounds Write

   NVD entryCISA catalog

5. CVE-2018-13382Used by ransomwareadded Jan 10 2022

   Fortinet FortiOS and FortiProxy Improper Authorization

   NVD entryCISA catalog

2021 4 vulnerabilities

1. CVE-2021-44168added Dec 10 2021

   Fortinet FortiOS Arbitrary File Download

   NVD entryCISA catalog

2. CVE-2020-12812Used by ransomwareadded Nov 3 2021

   Fortinet FortiOS SSL VPN Improper Authentication Vulnerability

   NVD entryCISA catalog

3. CVE-2019-5591Used by ransomwareadded Nov 3 2021

   Fortinet FortiOS Default Configuration Vulnerability

   NVD entryCISA catalog

4. CVE-2018-13379Used by ransomwareadded Nov 3 2021

   Fortinet FortiOS SSL VPN Path Traversal Vulnerability

   NVD entryCISA catalog