# Fortinet vulnerabilities > Fortinet has 951 published vulnerabilities across 262 products in our catalogue. 23 of them are on the list of flaws known to be exploited, so criminals are using them now. The most affected product is FortiOS, with 240. If you run Fortinet software, patch the exploited flaws first. Canonical page: https://www.edgeprotect.io/vendors/fortinet ## At a glance - **Published vulnerabilities:** 951 - **Known to be exploited:** 23 - **Products:** 262 - **Versions:** 3,055 - **Most recently added to the known-exploited list:** [CVE-2026-35616](https://www.edgeprotect.io/what-is/cve-2026-35616), 6 April 2026. We keep watching the list. ## Which Fortinet products have the most vulnerabilities? - [FortiOS](https://www.edgeprotect.io/product/fortinet/fortios): 240 published vulnerabilities, 278 versions - [FortiProxy](https://www.edgeprotect.io/product/fortinet/fortiproxy): 105 published vulnerabilities, 101 versions - [FortiWeb](https://www.edgeprotect.io/product/fortinet/fortiweb): 103 published vulnerabilities, 146 versions - [FortiManager](https://www.edgeprotect.io/product/fortinet/fortimanager): 94 published vulnerabilities, 153 versions - [FortiClient](https://www.edgeprotect.io/product/fortinet/forticlient): 75 published vulnerabilities, 123 versions - [FortiAnalyzer](https://www.edgeprotect.io/product/fortinet/fortianalyzer): 74 published vulnerabilities, 139 versions - [FortiPortal](https://www.edgeprotect.io/product/fortinet/fortiportal): 42 published vulnerabilities, 84 versions - [FortiADC](https://www.edgeprotect.io/product/fortinet/fortiadc): 40 published vulnerabilities, 126 versions - [FortiSandbox](https://www.edgeprotect.io/product/fortinet/fortisandbox): 40 published vulnerabilities, 72 versions - [FortiMail](https://www.edgeprotect.io/product/fortinet/fortimail): 38 published vulnerabilities, 125 versions Each product page lists its own known-exploited flaws. ## Which Fortinet vulnerabilities are being exploited? 23 flaws are on the government list of vulnerabilities known to be exploited, newest first: - [CVE-2026-35616](https://www.edgeprotect.io/what-is/cve-2026-35616): Fortinet FortiClient EMS Improper Access Control Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 89%, known exploited since 6 April 2026. - [CVE-2025-59718](https://www.edgeprotect.io/what-is/cve-2025-59718): Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 66%, known exploited since 16 December 2025. - [CVE-2025-64446](https://www.edgeprotect.io/what-is/cve-2025-64446): Fortinet FortiWeb Path Traversal Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 89%, known exploited since 14 November 2025. - [CVE-2025-25257](https://www.edgeprotect.io/what-is/cve-2025-25257): Fortinet FortiWeb SQL Injection Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 97%, known exploited since 18 July 2025. - [CVE-2019-6693](https://www.edgeprotect.io/what-is/cve-2019-6693): Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability. Medium, CVSS 6.5, chance of use in 30 days 5.7%, known exploited since 25 June 2025. - [CVE-2025-32756](https://www.edgeprotect.io/what-is/cve-2025-32756): Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 31%, known exploited since 14 May 2025. - [CVE-2025-24472](https://www.edgeprotect.io/what-is/cve-2025-24472): Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability. High, CVSS 8.1, chance of use in 30 days 3.0%, known exploited since 18 March 2025. - [CVE-2024-55591](https://www.edgeprotect.io/what-is/cve-2024-55591): Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 98%, known exploited since 14 January 2025. - [CVE-2024-47575](https://www.edgeprotect.io/what-is/cve-2024-47575): Fortinet FortiManager Missing Authentication Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 95%, known exploited since 23 October 2024. - [CVE-2024-23113](https://www.edgeprotect.io/what-is/cve-2024-23113): Fortinet Multiple Products Format String Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 62%, known exploited since 9 October 2024. - [CVE-2023-48788](https://www.edgeprotect.io/what-is/cve-2023-48788): Fortinet FortiClient EMS SQL Injection Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 98%, known exploited since 25 March 2024. - [CVE-2024-21762](https://www.edgeprotect.io/what-is/cve-2024-21762): Fortinet FortiOS Out-of-Bound Write Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 83%, known exploited since 9 February 2024. - [CVE-2023-27997](https://www.edgeprotect.io/what-is/cve-2023-27997): Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 86%, known exploited since 13 June 2023. - [CVE-2022-41328](https://www.edgeprotect.io/what-is/cve-2022-41328): Fortinet FortiOS Path Traversal Vulnerability. Medium, CVSS 6.7, chance of use in 30 days 12%, known exploited since 14 March 2023. - [CVE-2022-42475](https://www.edgeprotect.io/what-is/cve-2022-42475): Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 13 December 2022. - [CVE-2022-40684](https://www.edgeprotect.io/what-is/cve-2022-40684): Fortinet Multiple Products Authentication Bypass Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 11 October 2022. - [CVE-2018-13374](https://www.edgeprotect.io/what-is/cve-2018-13374): Fortinet FortiOS and FortiADC Improper Access Control Vulnerability. Medium, CVSS 4.3, chance of use in 30 days 38%, known exploited since 8 September 2022. - [CVE-2018-13382](https://www.edgeprotect.io/what-is/cve-2018-13382): Fortinet FortiOS and FortiProxy Improper Authorization. Critical, CVSS 9.1, chance of use in 30 days 82%, known exploited since 10 January 2022. - [CVE-2018-13383](https://www.edgeprotect.io/what-is/cve-2018-13383): Fortinet FortiOS and FortiProxy Out-of-bounds Write. Medium, CVSS 4.3, chance of use in 30 days 34%, known exploited since 10 January 2022. - [CVE-2021-44168](https://www.edgeprotect.io/what-is/cve-2021-44168): Fortinet FortiOS Arbitrary File Download. Low, CVSS 3.3, chance of use in 30 days 0.9%, known exploited since 10 December 2021. - [CVE-2020-12812](https://www.edgeprotect.io/what-is/cve-2020-12812): Fortinet FortiOS SSL VPN Improper Authentication Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 49%, known exploited since 3 November 2021. - [CVE-2018-13379](https://www.edgeprotect.io/what-is/cve-2018-13379): Fortinet FortiOS SSL VPN Path Traversal Vulnerability. Critical, CVSS 9.1, chance of use in 30 days >99%, known exploited since 3 November 2021. - [CVE-2019-5591](https://www.edgeprotect.io/what-is/cve-2019-5591): Fortinet FortiOS Default Configuration Vulnerability. Medium, CVSS 6.5, chance of use in 30 days 19%, known exploited since 3 November 2021. ## Which Fortinet flaws are most likely to be used? Ranked by the latest exploit-likelihood forecast (the chance each flaw is used in an attack in the next 30 days): - [CVE-2018-13379](https://www.edgeprotect.io/what-is/cve-2018-13379): >99%, Critical (CVSS 9.1), known exploited - [CVE-2022-40684](https://www.edgeprotect.io/what-is/cve-2022-40684): >99%, Critical (CVSS 9.8), known exploited - [CVE-2022-39952](https://www.edgeprotect.io/what-is/cve-2022-39952): >99%, Critical (CVSS 9.8) - [CVE-2022-42475](https://www.edgeprotect.io/what-is/cve-2022-42475): >99%, Critical (CVSS 9.8), known exploited - [CVE-2024-55591](https://www.edgeprotect.io/what-is/cve-2024-55591): 98%, Critical (CVSS 9.8), known exploited ## All Fortinet products we track 89 products with at least one tracked version, most vulnerabilities first: - [FortiOS](https://www.edgeprotect.io/product/fortinet/fortios): 240 vulnerabilities, 278 versions - [FortiProxy](https://www.edgeprotect.io/product/fortinet/fortiproxy): 105 vulnerabilities, 101 versions - [FortiWeb](https://www.edgeprotect.io/product/fortinet/fortiweb): 103 vulnerabilities, 146 versions - [FortiManager](https://www.edgeprotect.io/product/fortinet/fortimanager): 94 vulnerabilities, 153 versions - [FortiClient](https://www.edgeprotect.io/product/fortinet/forticlient): 75 vulnerabilities, 123 versions - [FortiAnalyzer](https://www.edgeprotect.io/product/fortinet/fortianalyzer): 74 vulnerabilities, 139 versions - [FortiPortal](https://www.edgeprotect.io/product/fortinet/fortiportal): 42 vulnerabilities, 84 versions - [FortiADC](https://www.edgeprotect.io/product/fortinet/fortiadc): 40 vulnerabilities, 126 versions - [FortiSandbox](https://www.edgeprotect.io/product/fortinet/fortisandbox): 40 vulnerabilities, 72 versions - [FortiMail](https://www.edgeprotect.io/product/fortinet/fortimail): 38 vulnerabilities, 125 versions - [FortiNAC](https://www.edgeprotect.io/product/fortinet/fortinac): 29 vulnerabilities, 74 versions - [FortiWLM](https://www.edgeprotect.io/product/fortinet/fortiwlm): 23 vulnerabilities, 16 versions - [FortiSIEM](https://www.edgeprotect.io/product/fortinet/fortisiem): 22 vulnerabilities, 101 versions - [FortiSOAR](https://www.edgeprotect.io/product/fortinet/fortisoar): 21 vulnerabilities, 29 versions - [FortiAuthenticator](https://www.edgeprotect.io/product/fortinet/fortiauthenticator): 21 vulnerabilities, 65 versions - [FortiManager Cloud](https://www.edgeprotect.io/product/fortinet/fortimanager_cloud): 19 vulnerabilities, 43 versions - [FortiNet Antivirus](https://www.edgeprotect.io/product/fortinet/fortinet_antivirus): 18 vulnerabilities, 1 version - [FortiPAM](https://www.edgeprotect.io/product/fortinet/fortipam): 18 vulnerabilities, 17 versions - [FortiVoice](https://www.edgeprotect.io/product/fortinet/fortivoice): 17 vulnerabilities, 68 versions - [FortiTester](https://www.edgeprotect.io/product/fortinet/fortitester): 16 vulnerabilities, 44 versions - [FortiWAN](https://www.edgeprotect.io/product/fortinet/fortiwan): 16 vulnerabilities, 27 versions - [FortiManager Firmware](https://www.edgeprotect.io/product/fortinet/fortimanager_firmware): 15 vulnerabilities, 24 versions - [FortiSwitchManager](https://www.edgeprotect.io/product/fortinet/fortiswitchmanager): 15 vulnerabilities, 15 versions - [FortiSwitch](https://www.edgeprotect.io/product/fortinet/fortiswitch): 12 vulnerabilities, 106 versions - [FortiAnalyzer Firmware](https://www.edgeprotect.io/product/fortinet/fortianalyzer_firmware): 12 vulnerabilities, 23 versions - [FortiWlc](https://www.edgeprotect.io/product/fortinet/fortiwlc): 11 vulnerabilities, 59 versions - [FortiAnalyzer Cloud](https://www.edgeprotect.io/product/fortinet/fortianalyzer_cloud): 11 vulnerabilities, 43 versions - [FortiRecorder](https://www.edgeprotect.io/product/fortinet/fortirecorder): 10 vulnerabilities, 32 versions - [FortiNAC-F](https://www.edgeprotect.io/product/fortinet/fortinac-f): 10 vulnerabilities, 16 versions - [FortiDeceptor](https://www.edgeprotect.io/product/fortinet/fortideceptor): 9 vulnerabilities, 51 versions - [FortiAnalyzer Big Data](https://www.edgeprotect.io/product/fortinet/fortianalyzer_big_data): 9 vulnerabilities, 24 versions - [FortiEDR](https://www.edgeprotect.io/product/fortinet/fortiedr): 7 vulnerabilities, 7 versions - [FortiNDR](https://www.edgeprotect.io/product/fortinet/fortindr): 7 vulnerabilities, 35 versions - [FortiAP-W2](https://www.edgeprotect.io/product/fortinet/fortiap-w2): 7 vulnerabilities, 49 versions - [FortiClient Enterprise Management Server](https://www.edgeprotect.io/product/fortinet/forticlient_enterprise_management_server): 7 vulnerabilities, 57 versions - [FortiAP-S](https://www.edgeprotect.io/product/fortinet/fortiap-s): 6 vulnerabilities, 36 versions - [FortiClient Endpoint Management Server](https://www.edgeprotect.io/product/fortinet/forticlient_endpoint_management_server): 6 vulnerabilities, 40 versions - [FortiAP-U](https://www.edgeprotect.io/product/fortinet/fortiap-u): 6 vulnerabilities, 19 versions - [FortiDDOS-F](https://www.edgeprotect.io/product/fortinet/fortiddos-f): 6 vulnerabilities, 23 versions - [FortiAP](https://www.edgeprotect.io/product/fortinet/fortiap): 5 vulnerabilities, 46 versions - [Fcm-Mb40 Firmware](https://www.edgeprotect.io/product/fortinet/fcm-mb40_firmware): 5 vulnerabilities, 1 version - [FortiIsolator](https://www.edgeprotect.io/product/fortinet/fortiisolator): 5 vulnerabilities, 26 versions - [FortiRecorder Firmware](https://www.edgeprotect.io/product/fortinet/fortirecorder_firmware): 5 vulnerabilities, 43 versions - [FortiADC Firmware](https://www.edgeprotect.io/product/fortinet/fortiadc_firmware): 5 vulnerabilities, 7 versions - [FortiExtender Firmware](https://www.edgeprotect.io/product/fortinet/fortiextender_firmware): 5 vulnerabilities, 33 versions - [FortiDLP Agent](https://www.edgeprotect.io/product/fortinet/fortidlp_agent): 4 vulnerabilities, 23 versions - [FortiSASE](https://www.edgeprotect.io/product/fortinet/fortisase): 4 vulnerabilities, 32 versions - [FortiDDOS](https://www.edgeprotect.io/product/fortinet/fortiddos): 4 vulnerabilities, 31 versions - [FortiWebManager](https://www.edgeprotect.io/product/fortinet/fortiwebmanager): 4 vulnerabilities, 9 versions - [FortiAiops](https://www.edgeprotect.io/product/fortinet/fortiaiops): 4 vulnerabilities, 1 version - [FortiClientEMS](https://www.edgeprotect.io/product/fortinet/forticlientems): 3 vulnerabilities, 45 versions - [FortiCamera Firmware](https://www.edgeprotect.io/product/fortinet/forticamera_firmware): 2 vulnerabilities, 13 versions - [FortiADC Manager](https://www.edgeprotect.io/product/fortinet/fortiadc_manager): 2 vulnerabilities, 10 versions - [FortiClient Sslvpn Client](https://www.edgeprotect.io/product/fortinet/forticlient_sslvpn_client): 2 vulnerabilities, 1 version - [Antivirus Engine](https://www.edgeprotect.io/product/fortinet/antivirus_engine): 2 vulnerabilities, 15 versions - [FortiGate](https://www.edgeprotect.io/product/fortinet/fortigate): 2 vulnerabilities, 1 version - [FortiOS IPS Engine](https://www.edgeprotect.io/product/fortinet/fortios_ips_engine): 2 vulnerabilities, 16 versions - [FortiPresence](https://www.edgeprotect.io/product/fortinet/fortipresence): 2 vulnerabilities, 14 versions - [FortiAP-C](https://www.edgeprotect.io/product/fortinet/fortiap-c): 2 vulnerabilities, 8 versions - [FortiToken Mobile](https://www.edgeprotect.io/product/fortinet/fortitoken_mobile): 2 vulnerabilities, 23 versions - [Connect](https://www.edgeprotect.io/product/fortinet/connect): 1 vulnerability, 4 versions - [Coyote Point Equalizer Firmware](https://www.edgeprotect.io/product/fortinet/coyote_point_equalizer_firmware): 1 vulnerability, 1 version - [FortiAI](https://www.edgeprotect.io/product/fortinet/fortiai): 1 vulnerability, 2 versions - [FortiAI Firmware](https://www.edgeprotect.io/product/fortinet/fortiai_firmware): 1 vulnerability, 6 versions - [FortiAnalyzer Bigdata](https://www.edgeprotect.io/product/fortinet/fortianalyzer_bigdata): 1 vulnerability, 1 version - [FortiAuthenticator Agent for Microsoft Outlook Web Access](https://www.edgeprotect.io/product/fortinet/fortiauthenticator_agent_for_microsoft_outlook_web_access): 1 vulnerability, 2 versions - [FortiClient Emergency Management Server](https://www.edgeprotect.io/product/fortinet/forticlient_emergency_management_server): 1 vulnerability, 1 version - [FortiClientEMS Cloud](https://www.edgeprotect.io/product/fortinet/forticlientems_cloud): 1 vulnerability, 36 versions - [FortiClient Lite](https://www.edgeprotect.io/product/fortinet/forticlient_lite): 1 vulnerability, 2 versions - [FortiClient SSL VPN](https://www.edgeprotect.io/product/fortinet/forticlient_ssl_vpn): 1 vulnerability, 1 version - [FortiClient Virtual Private Network](https://www.edgeprotect.io/product/fortinet/forticlient_virtual_private_network): 1 vulnerability, 1 version - [FortiConverter](https://www.edgeprotect.io/product/fortinet/forticonverter): 1 vulnerability, 3 versions - [FortiDb](https://www.edgeprotect.io/product/fortinet/fortidb): 1 vulnerability, 1 version - [FortiEDRManager](https://www.edgeprotect.io/product/fortinet/fortiedrmanager): 1 vulnerability, 4 versions - [FortiGate-1000](https://www.edgeprotect.io/product/fortinet/fortigate-1000): 1 vulnerability, 1 version - [FortiGuard Antivirus](https://www.edgeprotect.io/product/fortinet/fortiguard_antivirus): 1 vulnerability, 1 version - [FortiGuest](https://www.edgeprotect.io/product/fortinet/fortiguest): 1 vulnerability, 1 version - [Fortinet](https://www.edgeprotect.io/product/fortinet/fortinet): 1 vulnerability, 1 version - [FortiOS-6k7k](https://www.edgeprotect.io/product/fortinet/fortios-6k7k): 1 vulnerability, 45 versions - FortiSandbox PaaS: 1 vulnerability, 4 versions - [FortiSdnconnector](https://www.edgeprotect.io/product/fortinet/fortisdnconnector): 1 vulnerability, 10 versions - [FortiSIEM Windows Agent](https://www.edgeprotect.io/product/fortinet/fortisiem_windows_agent): 1 vulnerability, 3 versions - [Single Sign on](https://www.edgeprotect.io/product/fortinet/single_sign_on): 1 vulnerability, 1 version - [FortiSOAR Imap Connector](https://www.edgeprotect.io/product/fortinet/fortisoar_imap_connector): 1 vulnerability, 3 versions - [FortiSRA](https://www.edgeprotect.io/product/fortinet/fortisra): 1 vulnerability, 8 versions - [FortiWeb Manager](https://www.edgeprotect.io/product/fortinet/fortiweb_manager): 1 vulnerability, 1 version - [FortiSandbox Cloud](https://www.edgeprotect.io/product/fortinet/fortisandbox_cloud): 0 vulnerabilities, 15 versions - [FortiFone Softclient](https://www.edgeprotect.io/product/fortinet/fortifone_softclient): 0 vulnerabilities, 2 versions - [FortiDDOS-Cm](https://www.edgeprotect.io/product/fortinet/fortiddos-cm): 0 vulnerabilities, 5 versions ## Questions ### How many vulnerabilities does Fortinet have? Our catalogue lists 951 published vulnerabilities across 262 products and 3,055 versions from Fortinet. The most recent Fortinet flaw added to the known-exploited list is CVE-2026-35616, on 6 April 2026. ### Which Fortinet vulnerabilities are being exploited? 23 Fortinet vulnerabilities are on the list of flaws known to be exploited. The most recently added are CVE-2026-35616, CVE-2025-59718 and CVE-2025-64446. The full list is on this page. ### Which Fortinet product has the most vulnerabilities? FortiOS, with 240 published vulnerabilities. Its own page lists the ones known to be exploited. ### How do I get alerts for new Fortinet vulnerabilities? Create a EdgeProtect account and track the Fortinet products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook. ## Running Fortinet? EdgeProtect keeps checking for you: - **Tell us what you run.** Pick your software from a list, or let us work it out from your website. - **We match it to every flaw.** Over 400,000 published flaws, checked against your list. - **Ranked by real-world risk.** Every flaw gets a 0 to 100 risk score, kept up to date, led by evidence criminals are using it. - **Told as soon as we know.** An alert by email, in the app or by webhook to your own tools. Start free (no card, nothing to install): https://www.edgeprotect.io/register Book a demo: https://www.edgeprotect.io/contact