PT-2026-87181

A use of uninitialized variable vulnerability in Fortinet FortiAnalyzer 7.6.3 through 7.6.6 may allow attacker to denial of service via...

The vulnerability of Fortinet FortiWeb web applications’ network firewalls, related to authentication procedures that allow attackers to bypass existing security restrictions.

The vulnerability of Fortinet FortiWeb network firewalls is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow attackers to bypass existing security restrictions remotely...

Exploit for Out-of-bounds Write in Fortinet Fortiproxy

FortiGate SSL-VPN kit recovered in the wild Research arch...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Fortinet Fortiproxy

CVE-2024-55591 - Fortinet FortiOS Authentication Bypass An ed...

vamp-forticheck

vamp-forticheck VampSecure Labs — Security Research Division Scanner di vulnerabilità critiche nei dispositivi FortiOS/FortiGate. Descrizione Strumento di audit di sicurezza per valutare l'esposizione dei dispositivi Fortinet rispetto a quattro vulnerabilità critiche pubblicamente documentate...

Exploit for Numeric Truncation Error in Fortinet Fortios

CVE-2022-42475 PoC Fortinet SSL VPN Pre-Authentication Remo...

EUVD-2026-57191

A Stack-based Buffer Overflow vulnerability CWE-121 vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6 may allow an unauthenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands in the context of the WAD daemon via crafted sockets, only if the explicit...

Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An...

Vulnerability handling in Fortinet FortiSandbox

Fortinet has identified a vulnerability in FortiSandbox. This vulnerability relates to an exposure or resource issue with the wrong spheres CWE-668 in the VNC-server component used within FortiSandbox’s scanning virtual machines. Unauthorized attackers can send network requests to gain access to...

Kwetsbaarheid verholpen in Fortinet FortiClient EMS

Fortinet has identified a vulnerability in FortiClient EMS versions 7.2 through 7.4.5. This vulnerability relates to the improper validation of certificates within FortiClient EMS. As a result, an external attacker who is not authenticated can impersonate an Active Directory Connector by using a...

The vulnerability of the FortiOS operating systems and the FortiProxy proxy server, related to the failure to handle CRLF sequences in HTTP headers, allows attackers to gain unauthorized access and modify authentication requests.

The vulnerability of the FortiOS operating systems and the FortiProxy proxy server for protecting against Internet attacks is related to the failure to handle CRLF sequences in HTTP headers. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access and modify...

Fortinet FortiSIEM 6.4.x < 7.2.7 / 7.3.x < 7.3.5 / 7.4.x < 7.4.1 XSS (FG-IR-26-149)

The version of Fortinet FortiSIEM running on the remote host is 6.4.x through 7.2.x prior to 7.2.7, 7.3.x prior to 7.3.5, or 7.4.0. It is, therefore, affected by a cross-site scripting vulnerability: - An improper neutralization of script-related HTML tags in a web page basic XSS vulnerability in...

Fortinet FortiSandbox OS Command Injection Vulnerability

Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests...

CVE-2026-59838

CVE-2026-59838 is an XSS-type vulnerability described as improper neutralization of script-related HTML tags in Fortinet FortiSIEM. Affected versions span FortiSIEM 7.4.0; 7.3.0–7.3.4; 7.2.0–7.2.6; 7.1.x; 7.0.x; and all 6.x versions (6.4–6.7). The issue could allow an attacker to execute unauthor...

Vulnerabilities exist in several Fortinet products

Fortinet has identified vulnerabilities in several versions of FortiSIEM Windows Agent and general product versions, FortiOS, FortiPAM, and FortiProxy. One vulnerability exists in the FortiSIEM Windows Agent versions 7.4.0 through 7.4.1 with the identifier CVE-2026-59841. This vulnerability allow...

EUVD-2026-43719

A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.2, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiProxy 7.6.0 through 7.6.5, FortiProxy 7.4.0 through 7.4.13, FortiProxy 7.2 all versions may allow attacker to information disclosure via...

EUVD-2026-43710

A exposure of resource to wrong sphere vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.3 through 4.4.8 may allow an unauthenticated attacker to access the VNC server of VMs performing scanning via network requests...

EUVD-2025-210467

A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.2, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions may allow an authenticated remote attacker to return a portion of device memory in the redirect response via submitting a specially crafted request...

EUVD-2025-210464

A out-of-bounds read vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.2, FortiAuthenticator 6.5 all versions may allow a remote unauthenticated attacker to retrieve sensitive information via a specially crafted request...

CVE-2026-23573

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability CWE-79 vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM 1.8.0, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5...