Is Fortinet safe right now?
1 flaw was added to CISA's list of actively exploited vulnerabilities in the last 30 days. If you run Fortinet, update now.
Exploited in the last 90 days
- Multiple ProductsFortinet Multiple Products Path Traversal Vulnerability
What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.
- FortiMailZero-dayFortinet FortiMail Path Traversal Vulnerability
What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.
- Multiple ProductsAttackers are hijacking unpatched FortiGate firewalls at scale
What to do: Update FortiOS and confirm the new version is running. Block UDP ports 5246 to 5249 from untrusted networks, and check for the signs of compromise in Fortinet's advisory.
Fixed in: FortiOS 7.6.4; 7.4.9; 7.2.12
Earlier exploited flaws
- Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
- Fortinet FortiSandbox OS Command Injection Vulnerability
- Fortinet FortiSandbox OS Command Injection Vulnerability
- Fortinet FortiClient EMS SQL Injection Vulnerability
- Fortinet FortiClient EMS Improper Access Control Vulnerability Zero-day
- Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability Zero-day
- Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability Zero-day
- Fortinet FortiWeb OS Command Injection Vulnerability Zero-day
- Fortinet FortiWeb Path Traversal Vulnerability Zero-day
- Fortinet FortiWeb SQL Injection Vulnerability Zero-day
- Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability
- Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability Zero-day
- Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
- Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability Zero-day
- Fortinet FortiManager Missing Authentication Vulnerability Zero-day
By year
| Year | Exploited flaws added | Zero-days |
|---|---|---|
| 2026 (so far) | 9 | 3 |
| 2025 | 8 | 6 |
| 2024 | 4 | 2 |
| 2023 | 2 | 2 |
| 2022 | 5 | 2 |
Questions
Is Fortinet safe right now?
1 flaw was added to CISA's list of actively exploited vulnerabilities in the last 30 days. If you run Fortinet, update now. Confirm with the vendor's own advisories and install updates as soon as they're available.
How many Fortinet vulnerabilities have been exploited?
32 flaws are on CISA's list of vulnerabilities known to be exploited in real attacks, 14 of them used by ransomware.
Covers products matching fortinet, forti. Sources: CISA's Known Exploited Vulnerabilities catalog and the vendors' own advisories. Updated every hour. General information only; confirm details with the vendor.