FortiOS vulnerabilities

95 known vulnerabilities in FortiOS from Fortinet. 89 are rated high or critical, and 21 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Fortinet FortiOS Heap-Based Buffer Overflow Exploited

  CVE-2022-42475Jan 2, 2023FortinetEPSS 99.5%

  A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote un

• 9.8 Critical severity

  FortiOS: Improper Authentication

  CVE-2022-35843Dec 6, 2022Fortinet

  An authentication bypass by assumed-immutable data vulnerability [CWE-302] in the FortiOS SSH login component 7.2.0, 7.0.0 through 7.0.7, 6.4.0 through 6.4.9, 6.2 all versions, 6.0 all versions and FortiProxy SSH login component 7.0.0 through 7.0.5, 2.0.0 thro

• 7.5 High severity

  Fortinet FortiOS: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2022-35842Nov 2, 2022Fortinet

  An exposure of sensitive information to an unauthorized actor vulnerabiltiy [CWE-200] in FortiOS SSL-VPN versions 7.2.0, versions 7.0.0 through 7.0.6 and versions 6.4.0 through 6.4.9 may allow a remote unauthenticated attacker to gain information about LDAP an

• 8.6 High severity

  Fortinet AV Engine, FortiMail, FortiOS…: Insufficient Verification of Data Authenticity

  CVE-2022-26122Nov 2, 2022Fortinet

  An insufficient verification of data authenticity vulnerability [CWE-345] in FortiClient, FortiMail and FortiOS AV engines version 6.2.168 and below and version 6.4.274 and below may allow an attacker to bypass the AV engine via manipulating MIME attachment wi

• 7.5 High severity

  Fortinet FortiOS, FortiProxy: Access of Uninitialized Pointer

  CVE-2022-29055Oct 18, 2022FortinetEPSS 1.13%

  A access of uninitialized pointer in Fortinet FortiOS version 7.2.0, 7.0.0 through 7.0.5, 6.4.0 through 6.4.8, 6.2.0 through 6.2.10, 6.0.x, FortiProxy version 7.0.0 through 7.0.4, 2.0.0 through 2.0.9, 1.2.x allows a remote unauthenticated or authenticated atta

• 9.8 Critical severity

  Fortinet Multiple Products Authentication Bypass Exploited

  CVE-2022-40684Oct 18, 2022FortinetEPSS 100%

  An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an una

• 7.8 High severity

  Fortinet FortiADC, FortiProxy, FortiMail…: Use of Externally-Controlled Format String

  CVE-2022-22299Aug 5, 2022Fortinet

  A format string vulnerability [CWE-134] in the command line interpreter of FortiADC version 6.0.0 through 6.0.4, FortiADC version 6.1.0 through 6.1.5, FortiADC version 6.2.0 through 6.2.1, FortiProxy version 1.0.0 through 1.0.7, FortiProxy version 1.1.0 throug

• 7.8 High severity

  Fortinet FortiOS Arbitrary File Download Exploited

  CVE-2021-44168Jan 4, 2022Fortinet

  A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attacker to download arbitrary files on the device via specially crafted update packages.

• 6.5 Medium severity

  Fortinet FortiOS Default Configuration Exploited

  CVE-2019-5591Aug 14, 2020FortinetEPSS 18.6%

  A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server.

• 9.8 Critical severity

  Fortinet FortiOS SSL VPN Improper Authentication Exploited

  CVE-2020-12812Jul 24, 2020Fortinet FortiOSEPSS 45.4%

  An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if they changed the case of

• 6.5 Medium severity

  Fortinet FortiOS Use of Hard-Coded Credentials Exploited

  CVE-2019-6693Nov 21, 2019FortinetEPSS 6.64%

  Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data incl

• 7.5 High severity

  Fortinet FortiOS and FortiProxy Improper Authorization Exploited

  CVE-2018-13382Jun 4, 2019FortinetEPSS 81.7%

  An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the passwo

• 9.8 Critical severity

  Fortinet FortiOS SSL VPN Path Traversal Exploited

  CVE-2018-13379Jun 4, 2019FortinetEPSS 100%

  An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an una

• 6.5 Medium severity

  Fortinet FortiOS and FortiProxy Out-of-bounds Write Exploited

  CVE-2018-13383May 29, 2019FortinetEPSS 30.7%

  A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users d

• 4.3 Medium severity

  Fortinet FortiOS and FortiADC Improper Access Control Exploited

  CVE-2018-13374Jan 22, 2019FortinetEPSS 38.1%

  A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connectivity test request to a