FortiADC vulnerabilities

19 known vulnerabilities in FortiADC from Fortinet. 18 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  FortiADC: Improper Neutralization of Special Elements used in an OS Command

  CVE-2025-49813Aug 12, 2025FortinetEPSS 1.1%

  An improper neutralization of special elements used in an OS Command ("OS Command Injection") vulnerability [CWE-78] in Fortinet FortiADC version 7.2.0 and before 7.1.1 allows a remote and authenticated attacker with low privilege to execute unauthorized code

• 7.2 High severity

  FortiADC: Improper Neutralization of Special Elements used in an OS Command

  CVE-2025-31104Jun 10, 2025FortinetEPSS 1.11%

  A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiADC 7.6.0 through 7.6.1, FortiADC 7.4.0 through 7.4.6, FortiADC 7.2.0 through 7.2.7, FortiADC 7.1.0 through 7.1.4, FortiADC 7.0 all vers

• 7.4 High severity

  FortiADC: Improper Certificate Validation

  CVE-2023-50178Jul 9, 2024Fortinet

  An improper certificate validation vulnerability [CWE-295] in FortiADC 7.4.0, 7.2.0 through 7.2.3, 7.1 all versions, 7.0 all versions, 6.2 all versions, 6.1 all versions and 6.0 all versions may allow a remote and unauthenticated attacker to perform a Man-in-t

• 9.1 Critical severity

  FortiDDoS-F: Permissive Cross-domain Security Policy with Untrusted Domains

  CVE-2023-25603Nov 14, 2023Fortinet

  A permissive cross-domain policy with untrusted domains vulnerability in Fortinet FortiADC 7.1.0 - 7.1.1, FortiDDoS-F 6.3.0 - 6.3.4 and 6.4.0 - 6.4.1 allow an unauthorized attacker to carry out privileged actions and retrieve sensitive information via crafted

• 8.8 High severity

  FortiADC: Improper Access Control

  CVE-2023-26205Nov 14, 2023Fortinet

  An improper access control vulnerability [CWE-284] in FortiADC automation feature 7.1.0 through 7.1.2, 7.0 all versions, 6.2 all versions, 6.1 all versions may allow an authenticated low-privileged attacker to escalate their privileges to super_admin via a spe

• 7.8 High severity

  FortiAnalyzer: Improper Neutralization of Special Elements used in an OS Command

  CVE-2023-25607Oct 10, 2023FortinetEPSS 1.65%

  An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78 ] in FortiManager 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions, FortiAnalyzer 7.2.0 throug

• 8.8 High severity

  FortiADC: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-35849Sep 13, 2023Fortinet

  An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiADC 7.1.0 through 7.1.1, 7.0.0 through 7.0.3, 6.2.0 through 6.2.5 and 6.1.0 all versions may allow an authenticated attacker to exec

• 7.8 High severity

  FortiADC: Improper Neutralization of Special Elements used in an OS Command

  CVE-2023-28000Jun 13, 2023Fortinet

  An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC CLI 7.1.0, 7.0.0 through 7.0.3, 6.2.0 through 6.2.4, 6.1 all versions, 6.0 all versions may allow a local and authenticated attacker to execute unauthorized

• 7.8 High severity

  FortiADC: Improper Neutralization of Special Elements used in an OS Command

  CVE-2023-26210Jun 13, 2023Fortinet

  Multiple improper neutralization of special elements used in an os command ('OS Command Injection') vulnerabilties [CWE-78] vulnerability in Fortinet allows a local authenticated attacker to execute arbitrary shell code as `root` user via crafted CLI requests.

• 7.8 High severity

  FortiADC: Improper Neutralization of Special Elements used in an OS Command

  CVE-2023-27999May 3, 2023Fortinet

  An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC 7.2.0, 7.1.0 through 7.1.1 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands.

• 7.1 High severity

  FortiADC: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2023-27993May 3, 2023Fortinet

  A relative path traversal [CWE-23] in Fortinet FortiADC version 7.2.0 and before 7.1.1 allows a privileged attacker to delete arbitrary directories from the underlying file system via crafted CLI commands.

• 7.8 High severity

  FortiWeb: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-43948Apr 11, 2023Fortinet

  A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 7.0.0 through 7.0.3, FortiADC version 7.1.0 through 7.1.1, FortiADC version 7.0.0 through 7.0.3, FortiADC 6.2 all versions, FortiADC 6.1 a

• 7.8 High severity

  FortiDDoS: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-40679Apr 11, 2023Fortinet

  An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC 5.x all versions, 6.0 all versions, 6.1 all versions, 6.2.0 through 6.2.4, 7.0.0 through 7.0.3, 7.1.0; FortiDDoS 4.x all versions, 5.0 all versions, 5.1 all

• 7.8 High severity

  FortiADC: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-27482Feb 16, 2023Fortinet

  A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiADC version 7.0.0 through 7.0.1, 6.2.0 through 6.2.2, 6.1.0 through 6.1.6, 6.0.x, 5.x.x allows attacker to execute arbitrary shell code as `root` via

• 8.8 High severity

  FortiADC: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-39947Jan 3, 2023FortinetEPSS 2.95%

  A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiADC version 7.0.0 through 7.0.2, FortiADC version 6.2.0 through 6.2.3, FortiADC version version 6.1.0 through 6.1.6, FortiADC version 6.0.0 through 6.

• 8.8 High severity

  FortiADC: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2022-33875Dec 6, 2022Fortinet

  An improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability in Fortinet FortiADC version 7.1.0, version 7.0.0 through 7.0.2 and version 6.2.4 and below allows an authenticated attacker to execute unauthorized code or c

• 7.8 High severity

  Fortinet FortiADC, FortiProxy, FortiMail…: Use of Externally-Controlled Format String

  CVE-2022-22299Aug 5, 2022Fortinet

  A format string vulnerability [CWE-134] in the command line interpreter of FortiADC version 6.0.0 through 6.0.4, FortiADC version 6.1.0 through 6.1.5, FortiADC version 6.2.0 through 6.2.1, FortiProxy version 1.0.0 through 1.0.7, FortiProxy version 1.1.0 throug

• 8.8 High severity

  Fortinet FortiADC: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2022-26120Jul 18, 2022Fortinet

  Multiple improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerabilities [CWE-89] in FortiADC management interface 7.0.0 through 7.0.1, 5.0.0 through 6.2.2 may allow an authenticated attacker to execute unauthorized code or

• 4.3 Medium severity

  Fortinet FortiOS and FortiADC Improper Access Control Exploited

  CVE-2018-13374Jan 22, 2019FortinetEPSS 38.1%

  A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connectivity test request to a