FortiManager Cloud vulnerabilities

59 known vulnerabilities in FortiManager Cloud from Fortinet. 59 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  FortiManager Cloud: Use of Externally-Controlled Format String

  CVE-2025-68648Mar 10, 2026Fortinet

  A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer Cloud 7.6.2, FortiAnalyzer Cloud 7.4.1 th

• 7.2 High severity

  FortiAnalyzer: Hidden Functionality

  CVE-2025-48418Mar 10, 2026Fortinet

  A hidden functionality vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.3, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2.0 through 7.2.10, FortiAnalyzer 7.0.0 through 7.0.14, FortiAnalyzer 6.4 all versions, FortiAnalyzer Cloud 7.6.2, FortiAnaly

• 7.2 High severity

  FortiManager: Heap-based Buffer Overflow

  CVE-2024-50571Oct 14, 2025Fortinet

  A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.0 through 7.4.5, FortiAnalyzer 7.2.0 through 7.2.9, FortiAnalyzer 7.0.0 through 7.0.13, FortiAnalyzer 6.4 all versions, FortiAnalyzer 6.2 all versions,

• 8.8 High severity

  FortiManager: Improper Neutralization of Special Elements used in a Command

  CVE-2024-46662Mar 14, 2025FortinetEPSS 2.27%

  A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiManager versions 7.4.1 through 7.4.3, FortiManager Cloud versions 7.4.1 through 7.4.3 allows attacker to escalation of privilege via specifically crafted pac

• 7.2 High severity

  FortiAnalyzer: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-40584Feb 11, 2025FortinetEPSS 2.01%

  An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiAnalyzer version 7.4.0 through 7.4.3, 7.2.0 through 7.2.5, 7.0.0 through 7.0.13, 6.4.0 through 6.4.15 and 6.2.2 through 6.2.13

• 7.7 High severity

  FortiManager: Use of Hard-coded Cryptographic Key

  CVE-2024-33504Feb 11, 2025Fortinet

  A use of hard-coded cryptographic key to encrypt sensitive data vulnerability [CWE-321] in FortiManager 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.9, 7.0 all versions, 6.4 all versions may allow an attacker with JSON API access permissions to

• 9.8 Critical severity

  FortiAnalyzer: Weak Authentication

  CVE-2024-50563Jan 16, 2025Fortinet

  A weak authentication in Fortinet FortiManager Cloud, FortiAnalyzer versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiAnalyzer Cloud versions 7.4.1 through 7.4.3, FortiManager versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiManager Cloud versions

• 7.8 High severity

  FortiAnalyzer Cloud: Incorrect Privilege Assignment

  CVE-2024-45331Jan 16, 2025Fortinet

  A incorrect privilege assignment vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.3, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all versions, FortiAnalyzer Cloud 7.4.1 through 7.4.2, FortiAnalyzer Cloud 7.2.1

• 8.8 High severity

  FortiManager: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-50566Jan 14, 2025FortinetEPSS 1.1%

  A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiManager Cloud 7.6.0 through 7.6.1, FortiManager Cloud 7.4.0 through 7.4.4, FortiManager Cloud 7.2.2 through 7.2.7, FortiManager 7.6.0 th

• 9.8 Critical severity

  FortiOS: Weak Authentication

  CVE-2024-48886Jan 14, 2025Fortinet

  A weak authentication in Fortinet FortiOS versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, FortiProxy versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.10, 7.0.0 through 7.0.17, 2.0.0 through 2.0.14, FortiManager ver

• 9.1 Critical severity

  FortiOS: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2024-48884Jan 14, 2025FortinetEPSS 15.2%

  A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.1 through 7.4.3, FortiManager Cloud 7.4.1 through 7.4.3, FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.4, F

• 7.5 High severity

  FortiManager: Missing Authentication for Critical Functionality

  CVE-2024-35277Jan 14, 2025Fortinet

  A missing authentication for critical function in Fortinet FortiPortal version 6.0.0 through 6.0.15, FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14 allows attacker to access to the configuration of the

• 9.8 Critical severity

  FortiAnalyzer: Out-of-bounds Write

  CVE-2024-35276Jan 14, 2025Fortinet

  A stack-based buffer overflow vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.3, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzer 7.0.0 through 7.0.12, FortiAnalyzer 6.4.0 through 6.4.14, FortiAnalyzer Cloud 7.4.1 through 7.4.3, FortiAnalyzer Cloud 7

• 8.8 High severity

  FortiManager: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2024-35275Jan 14, 2025Fortinet

  A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiAnalyzer version 7.4.0 through 7.4.2, FortiManager version 7.4.0 through 7.4.2 allows attacker to escalation of privilege via specially crafted http request

• 8.8 High severity

  FortiAnalyzer: Out-of-bounds Write

  CVE-2024-35273Jan 14, 2025Fortinet

  A out-of-bounds write in Fortinet FortiManager version 7.4.0 through 7.4.2, FortiAnalyzer version 7.4.0 through 7.4.2 allows attacker to escalation of privilege via specially crafted http requests.

• 7.8 High severity

  FortiManager Cloud: Incorrect Privilege Assignment

  CVE-2024-33503Jan 14, 2025Fortinet

  A improper privilege management vulnerability in Fortinet FortiManager Cloud 7.4.1 through 7.4.3, FortiManager Cloud 7.2.1 through 7.2.5, FortiManager Cloud 7.0 all versions, FortiManager 7.4.0 through 7.4.3, FortiManager 7.2.0 through 7.2.5, FortiManager 7.0

• 7.2 High severity

  FortiManager: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-48889Dec 18, 2024FortinetEPSS 1.66%

  An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiManager version 7.6.0, version 7.4.4 and below, version 7.2.7 and below, version 7.0.12 and below, version 6.4.14 and below and FortiMa

• 7.3 High severity

  FortiAnalyzer: Out-of-bounds Write

  CVE-2024-33505Nov 12, 2024Fortinet

  A heap-based buffer overflow in Fortinet FortiAnalyzer version 7.4.0 through 7.4.2, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14 allow

• 9.8 Critical severity

  Fortinet FortiManager Missing Authentication Exploited

  CVE-2024-47575Oct 23, 2024FortinetEPSS 94.8%

  A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through 6.4.14, FortiManager 6.2.0 through 6.2.12, Fortinet FortiMan