CVE-2024-52964

An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability CWE-22 in Fortinet FortiManager version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.9 and below 7.0.13 & FortiManager Cloud version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5 and before 7.2...

CVE-2024-52964

An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability CWE-22 in Fortinet FortiManager version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.9 and below 7.0.13 & FortiManager Cloud version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5 and before 7.2...

CVE-2024-52964

Fortinet FortiManager and FortiManager Cloud are affected by a Path Traversal (CWE-22) vulnerability (CVE-2024-52964). An authenticated remote attacker can overwrite arbitrary files via FGFM crafted requests. Affected versions include FortiManager 7.6.0–7.6.1, 7.4.0–7.4.5, 7.2.0–7.2.9, and all re...

CVE-2025-53744

An incorrect privilege assignment vulnerability CWE-266 in FortiOS Security Fabric version 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, 7.2 all versions, 7.0 all versions, 6.4 all versions, may allow a remote authenticated attacker with high privileges to escalate their privileges to super-admin via...

CVE-2025-53744

An incorrect privilege assignment vulnerability CWE-266 in FortiOS Security Fabric version 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, 7.2 all versions, 7.0 all versions, 6.4 all versions, may allow a remote authenticated attacker with high privileges to escalate their privileges to super-admin via...

CVE-2025-53744

CVE-2025-53744 affects FortiOS Security Fabric across multiple lines: FortiOS Security Fabric versions 7.6.0–7.6.2, 7.4.0–7.4.7, 7.2, 7.0, and 6.4 all are vulnerable to an improper privilege assignment (CWE-266) that can let a remote authenticated attacker with high privileges escalate to super-a...

CVE-2025-53744

An incorrect privilege assignment vulnerability CWE-266 in FortiOS Security Fabric version 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, 7.2 all versions, 7.0 all versions, 6.4 all versions, may allow a remote authenticated attacker with high privileges to escalate their privileges to super-admin via...

Fortinet SSL VPNs Hit by Global Brute-Force Wave Before Attackers Shift to FortiManager

Cybersecurity researchers are warning of a "significant spike" in brute-force traffic aimed at Fortinet SSL VPN devices. The coordinated activity, per threat intelligence firm GreyNoise, was observed on August 3, 2025, with over 780 unique IP addresses participating in the effort. As many as 56...

Fortinet FortiManager和Fortinet FortiManager Cloud 路径遍历漏洞

Fortinet FortiManager and Fortinet FortiManager Cloud are both products of Fortinet, Inc. Fortinet FortiManager is a centralized network security management platform. The platform supports centralized management of any number of Fortinet devices, and can group devices into different management...

PT-2025-32873 · Fortinet · Fortimanager Cloud +1

Name of the Vulnerable Software and Affected Versions: Fortinet FortiManager versions 7.6.0 through 7.6.1 Fortinet FortiManager versions 7.4.0 through 7.4.5 Fortinet FortiManager versions 7.2.0 through 7.2.9 Fortinet FortiManager versions prior to 7.0.13 Fortinet FortiManager Cloud versions 7.6.0...

PT-2025-32884 · Fortinet · Fortios Security Fabric

Name of the Vulnerable Software and Affected Versions: FortiOS Security Fabric versions 6.4 all versions FortiOS Security Fabric versions 7.0 all versions FortiOS Security Fabric versions 7.2 all versions FortiOS Security Fabric versions 7.4.0 through 7.4.7 FortiOS Security Fabric versions 7.6.0...

Fortinet Fortigate Incorrect Privilege Assignment in Security Fabric (FG-IR-25-173)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-25-173 advisory. - An incorrect privilege assignment vulnerability CWE-266 in FortiOS Security Fabric version 7.6.0 through 7.6.2, 7.4.0 throu...

PT-2025-32870

Name of the Vulnerable Software and Affected Versions: Fortinet FortiOS versions 6.4.0 through 6.4.15 and versions prior to 6.2.16 Fortinet FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8 and versions prior to 7.0.15 Fortinet FortiPAM versions prior to 1.2.0 Description: An...

Fortinet FortiManager Arbitrary file overwrite in FGFMd (FG-IR-24-473)

The version of FortiManager installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-24-473 advisory. - An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability CWE-22 in Fortinet...

Fortinet Fortigate Weak authentication - FGFM protocol (FG-IR-24-042)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-24-042 advisory. - An authentication bypass using an alternate path or channel CWE-288 vulnerability in Fortinet FortiOS version 6.4.0 through...

The vulnerability of the software tools for centralized device management of Fortinet’s FortiManager and FortiManager Cloud, as well as the security monitoring and analysis tools FortiAnalyzer and FortiAnalyzer Cloud, stems from the lack of protective measures for the SQL query structure. This allows attackers to exploit the system to disclose sensitive information.

The vulnerability of the software solutions for centralized device management of Fortinet’s FortiManager and FortiManager Cloud, as well as the security event monitoring and analysis solutions of FortiAnalyzer and FortiAnalyzer Cloud, is related to the lack of protective measures for the SQL quer...

Fortinet FortiManager SQLi (FG-IR-24-437)

The version of FortiManager installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-24-437 advisory. - An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 in FortiManag...

CVE-2025-24474

An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 in FortiManager 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, 7.2 all versions, 7.0 all versions, 6.4 all versions; FortiManager Cloud 7.4.1 through 7.4.6, 7.2 all versions, 7.0 all versions, 6....

CVE-2025-24474

An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 in FortiManager 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, 7.2 all versions, 7.0 all versions, 6.4 all versions; FortiManager Cloud 7.4.1 through 7.4.6, 7.2 all versions, 7.0 all versions, 6....

CVE-2025-24474

An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 in FortiManager 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, 7.2 all versions, 7.0 all versions, 6.4 all versions; FortiManager Cloud 7.4.1 through 7.4.6, 7.2 all versions, 7.0 all versions, 6....