Fortinet
32 Fortinet flaws are on CISA's list of vulnerabilities attackers have used, 9 of them added in 2026. CISA says 14 are known to be used by ransomware. The latest was added Oct 16, 2026.
32on CISA's list, all time
9added in 2026
3in the last 90 days
14used by ransomware
16zero-days, all time
Exploited flaws added each year
Most-hit products
| Product | Exploited flaws | Most recent |
|---|---|---|
| FortiOS | 9 | Jul 27, 2026 |
| Multiple Products | 7 | Oct 16, 2026 |
| FortiOS and FortiProxy | 4 | Mar 18, 2025 |
| FortiClient EMS | 3 | Apr 13, 2026 |
| FortiWeb | 3 | Nov 18, 2025 |
| FortiSandbox | 2 | Jul 16, 2026 |
| FortiMail | 1 | Oct 1, 2026 |
| FortiManager | 1 | Oct 23, 2024 |
| FortiOS and FortiProxy SSL-VPN | 1 | Jun 13, 2023 |
| FortiOS and FortiADC | 1 | Sep 8, 2022 |
Latest Fortinet flaws
- Multiple ProductsFortinet Multiple Products Path Traversal Vulnerability
- FortiMailFortinet FortiMail Path Traversal Vulnerability
- Multiple ProductsFortinet Multiple Products Heap-based Buffer Overflow Vulnerability
- FortiOSFortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
- FortiSandboxFortinet FortiSandbox OS Command Injection Vulnerability
- FortiSandboxFortinet FortiSandbox OS Command Injection Vulnerability
- FortiClient EMSFortinet FortiClient EMS SQL Injection Vulnerability
- FortiClient EMSFortinet FortiClient EMS Improper Access Control Vulnerability
- Multiple ProductsFortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability
- Multiple ProductsFortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability
- FortiWebFortinet FortiWeb OS Command Injection Vulnerability
- FortiWebFortinet FortiWeb Path Traversal Vulnerability
- FortiWebFortinet FortiWeb SQL Injection Vulnerability
- FortiOSFortinet FortiOS Use of Hard-Coded Credentials Vulnerability
- Multiple ProductsFortinet Multiple Products Stack-Based Buffer Overflow Vulnerability
Counts come from CISA's Known Exploited Vulnerabilities catalog, which lists flaws with reliable evidence of real attacks. A higher count often reflects how widely a vendor's products are used and targeted, not only how secure they are.