FortiOS sürümleri ve açıkları
Denetta FortiOS sürüm tablosu, FortiOS 6.4 ve sonrasındaki her yamanın build numarasını, çıkış tarihini ve destek durumunu listeler ve her yamada hâlâ açık kalan güvenlik açıklarını CVE.org, CISA KEV ve FIRST EPSS verisiyle gösterir. Her açık için, her branch’te o açığı kapatan ilk sürüm de tablodadır. Resmî olmayan bir derlemedir; Fortinet ile bağlantısı yoktur.
Hangi FortiOS sürümleri hâlâ destekleniyor?
Destek sonu (EOS) geçmiş bir branch artık yama almaz. Son yamadaki açık sayısı, o branch’i en güncel hâlinde kullanan bir cihazın taşıdığı bilinen açıklardır.
| Branch | Durum | Son yama | Çıkış | Destek sonu (EOS) | Mühendislik desteği sonu | Son yamada açık |
|---|---|---|---|---|---|---|
| FortiOS 8.0 | Destekleniyor | 8.0.2 build 0251 | 2026-10-22 | belirsiz | belirsiz | 0 |
| FortiOS 7.6 | Destekleniyor | 7.6.8 build 3744 | 2026-10-22 | 2030-01-25 | 2028-07-25 | 0 |
| FortiOS 7.4 | Destekleniyor | 7.4.13 build 2933 | 2026-10-22 | 2028-11-11 | 2027-05-11 | 1 |
| FortiOS 7.2 | Destek bitti | 7.2.14 build 1778 | 2026-10-22 | 2026-09-30 | 2025-03-31 | 1 |
| FortiOS 7.0 | Destek bitti | 7.0.19 build 0696 | 2026-01-30 | 2025-09-30 | 2024-03-30 | 23 · 2 KEV |
| FortiOS 6.4 | Destek bitti | 6.4.16 build 2098 | 2025-03-27 | 2024-09-30 | 2023-03-31 | 52 · 3 KEV |
Tüm FortiOS yamaları
Her satır bir yamadır. Açık o yamada hâlâ etkili olan CVE’leri, KEV bunlardan fiilen istismar edilenleri, Kapanan bir önceki yamaya göre kapatılanları sayar. Build numarasını cihazda get system status çıktısının Version: satırında görürsünüz.
FortiOS 8.0
| Sürüm | Build | Çıkış tarihi | Açık | KEV | Kritik (CVSS ≥ 9) | Kapanan |
|---|---|---|---|---|---|---|
| 8.0.2son yama | 0251 | 2026-10-22 | 0 | 0 | 0 | 0 |
| 8.0.1 | 0245 | 2026-09-15 | 0 | 0 | 0 | 0 |
| 8.0.0 | 0167 | 2026-04-21 | 0 | 0 | 0 | 0 |
FortiOS 7.6
| Sürüm | Build | Çıkış tarihi | Açık | KEV | Kritik (CVSS ≥ 9) | Kapanan |
|---|---|---|---|---|---|---|
| 7.6.8son yama | 3744 | 2026-10-22 | 0 | 0 | 0 | 1 |
| 7.6.7 | 3704 | 2026-06-02 | 1 | 0 | 0 | 6 |
| 7.6.6 | 3652 | 2026-01-28 | 7 | 0 | 0 | 1 |
| 7.6.5 | 3651 | 2025-12-11 | 8 | 1 | 1 | 5 |
| 7.6.4 | 3596 | 2025-08-21 | 13 | 2 | 1 | 9 |
| 7.6.3 | 3510 | 2025-04-16 | 22 | 3 | 2 | 12 |
| 7.6.2 | 3462 | 2025-01-28 | 34 | 4 | 2 | 5 |
| 7.6.1 | 3457 | 2024-11-28 | 39 | 5 | 2 | 17 |
| 7.6.0 | 3401 | 2024-07-25 | 54 | 5 | 3 | 0 |
FortiOS 7.4
| Sürüm | Build | Çıkış tarihi | Açık | KEV | Kritik (CVSS ≥ 9) | Kapanan |
|---|---|---|---|---|---|---|
| 7.4.13son yama | 2933 | 2026-10-22 | 1 | 0 | 0 | 5 |
| 7.4.12 | 2902 | 2026-05-07 | 6 | 0 | 0 | 2 |
| 7.4.11 | 2878 | 2026-01-27 | 8 | 0 | 0 | 1 |
| 7.4.10 | 2867 | 2026-01-19 | 9 | 1 | 1 | 5 |
| 7.4.9 | 2829 | 2025-09-25 | 14 | 2 | 1 | 11 |
| 7.4.8 | 2795 | 2025-05-27 | 25 | 3 | 2 | 10 |
| 7.4.7 | 2731 | 2025-01-21 | 35 | 4 | 2 | 8 |
| 7.4.6 | 2726 | 2024-12-12 | 43 | 5 | 3 | 4 |
| 7.4.5 | 2702 | 2024-09-17 | 46 | 5 | 3 | 16 |
| 7.4.4 | 2662 | 2024-05-15 | 62 | 5 | 3 | 14 |
| 7.4.3 | 2573 | 2024-02-07 | 74 | 5 | 2 | 4 |
| 7.4.2 | 2571 | 2023-12-20 | 78 | 7 | 4 | 19 |
| 7.4.1 | 2463 | 2023-08-31 | 97 | 7 | 5 | 7 |
| 7.4.0 | 2360 | 2023-05-11 | 103 | 7 | 5 | 0 |
FortiOS 7.2
Bu branch’in desteği bitti; yeni açıklar için yama çıkmayabilir.
| Sürüm | Build | Çıkış tarihi | Açık | KEV | Kritik (CVSS ≥ 9) | Kapanan |
|---|---|---|---|---|---|---|
| 7.2.14son yama | 1778 | 2026-10-22 | 1 | 0 | 0 | 20 |
| 7.2.13 | 1762 | 2026-01-29 | 21 | 2 | 0 | 7 |
| 7.2.12 | 1761 | 2025-09-10 | 28 | 3 | 1 | 11 |
| 7.2.11 | 1740 | 2025-02-12 | 39 | 5 | 2 | 14 |
| 7.2.10 | 1706 | 2024-09-19 | 53 | 5 | 2 | 4 |
| 7.2.9 | 1688 | 2024-08-15 | 57 | 5 | 2 | 11 |
| 7.2.8 | 1639 | 2024-03-14 | 68 | 5 | 2 | 15 |
| 7.2.7 | 1577 | 2024-02-07 | 83 | 5 | 2 | 9 |
| 7.2.6 | 1575 | 2023-09-28 | 91 | 7 | 4 | 12 |
| 7.2.5 | 1517 | 2023-06-08 | 103 | 7 | 5 | 16 |
| 7.2.4 | 1396 | 2023-01-31 | 116 | 8 | 6 | 16 |
| 7.2.3 | 1262 | 2022-11-10 | 129 | 8 | 8 | 3 |
| 7.2.2 | 1255 | 2022-10-03 | 132 | 9 | 9 | 1 |
| 7.2.1 | 1254 | 2022-08-04 | 133 | 10 | 10 | 13 |
| 7.2.0 | 1157 | 2022-03-31 | 145 | 10 | 10 | 0 |
FortiOS 7.0
Bu branch’in desteği bitti; yeni açıklar için yama çıkmayabilir.
| Sürüm | Build | Çıkış tarihi | Açık | KEV | Kritik (CVSS ≥ 9) | Kapanan |
|---|---|---|---|---|---|---|
| 7.0.19son yama | 0696 | 2026-01-30 | 23 +1? | 2 | 0 | 11 |
| 7.0.18 | 0695 | 2025-11-06 | 34 +1? | 3 | 1 | 9 |
| 7.0.17 | 0682 | 2025-01-14 | 43 +1? | 4 | 2 | 15 |
| 7.0.16 | 0667 | 2024-10-22 | 58 +1? | 6 | 3 | 13 |
| 7.0.15 | 0632 | 2024-04-04 | 71 +1? | 6 | 3 | 8 |
| 7.0.14 | 0601 | 2024-02-07 | 79 +1? | 6 | 3 | 8 |
| 7.0.13 | 0566 | 2023-10-26 | 86 +1? | 8 | 5 | 13 |
| 7.0.12 | 0523 | 2023-06-08 | 99 +1? | 8 | 6 | 10 |
| 7.0.11 | 0489 | 2023-03-16 | 108 +1? | 9 | 7 | 9 |
| 7.0.10 | 0450 | 2023-02-23 | 117 +1? | 9 | 8 | 7 |
| 7.0.9 | 0444 | 2022-11-22 | 124 +1? | 10 | 9 | 5 |
| 7.0.8 | 0418 | 2022-10-13 | 129 +1? | 11 | 10 | 6 |
| 7.0.7 | 0367 | 2022-10-06 | 135 +1? | 11 | 10 | 3 |
| 7.0.6 | 0366 | 2022-06-07 | 138 +1? | 12 | 11 | 7 |
| 7.0.5 | 0304 | 2022-02-09 | 144 +1? | 12 | 11 | 0 |
| 7.0.4 | 0301 | 2022-01-27 | 144 +1? | 12 | 11 | 7 |
| 7.0.3 | 0237 | 2021-12-07 | 150 +1? | 12 | 12 | 3 |
| 7.0.2 | 0234 | 2021-10-20 | 153 +1? | 13 | 12 | 2 |
| 7.0.1 | 0157 | 2021-07-15 | 154 +1? | 13 | 12 | 7 |
| 7.0.0 | 0066 | 2021-03-30 | 159 +1? | 13 | 12 | 0 |
FortiOS 6.4
Bu branch’in desteği bitti; yeni açıklar için yama çıkmayabilir.
| Sürüm | Build | Çıkış tarihi | Açık | KEV | Kritik (CVSS ≥ 9) | Kapanan |
|---|---|---|---|---|---|---|
| 6.4.16son yama | 2098 | 2025-03-27 | 52 +1? | 3 | 0 | 26 |
| 6.4.15 | 2095 | 2024-02-07 | 78 +1? | 3 | 0 | 10 |
| 6.4.14 | 2093 | 2023-06-26 | 88 +1? | 4 | 2 | 2 |
| 6.4.13 | 2092 | 2023-06-08 | 90 +1? | 4 | 2 | 13 |
| 6.4.12 | 2060 | 2023-02-23 | 102 +1? | 5 | 3 | 11 |
| 6.4.11 | 2030 | 2022-11-01 | 113 +1? | 6 | 4 | 1 |
| 6.4.10 | 2000 | 2022-08-25 | 114 +1? | 7 | 5 | 9 |
| 6.4.9 | 1966 | 2022-04-26 | 123 +1? | 7 | 5 | 6 |
| 6.4.8 | 1914 | 2021-11-18 | 129 +1? | 7 | 6 | 1 |
| 6.4.7 | 1911 | 2021-08-26 | 130 +1? | 7 | 6 | 5 |
| 6.4.6 | 1879 | 2021-05-20 | 134 +1? | 7 | 6 | 0 |
| 6.4.5 | 1828 | 2021-02-18 | 131 +1? | 7 | 6 | 1 |
| 6.4.4 | 1803 | 2020-12-10 | 132 +1? | 7 | 6 | 0 |
| 6.4.3 | 1778 | 2020-10-22 | 132 +1? | 7 | 6 | 0 |
| 6.4.2 | 1723 | 2020-07-30 | 131 +1? | 7 | 6 | 1 |
| 6.4.1 | 1637 | 2020-06-04 | 131 +1? | 7 | 6 | 1 |
| 6.4.0 | 1579 | 2020-03-31 | 132 +1? | 8 | 6 | 0 |
Hangi açık hangi sürümde kapandı?
Her FortiOS açığı için her branch’te açığı kapatan ilk yama. — o branch’in etkilenmediğini, yama yok branch’in son yamasının da etkilendiğini (branch yükseltmesi gerekir), ? sürüm aralığının okunamadığını gösterir. Fiilen istismar edilenler (KEV) önce gelir.
| CVE | CVSS | EPSS | 8.0 | 7.6 | 7.4 | 7.2 | 7.0 | 6.4 |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-61624KEV Yayım 2026-04-14An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all… | 5.4 | 1.1% | — | 7.6.5 | 7.4.10 | 7.2.14 | yama yok | yama yok |
| CVE-2025-68686KEV Yayım 2026-02-10An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2 all versions, FortiOS 7.0 all… | 5.3 | 29.5% | — | 7.6.2 | 7.4.7 | 7.2.14 | yama yok | yama yok |
| CVE-2026-24858KEV Yayım 2026-01-27An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11,… | 9.4 | 85.8% | — | 7.6.6 | 7.4.11 | 7.2.13 | 7.0.19 | — |
| CVE-2025-25249KEV Yayım 2026-01-13A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions,… | 7.4 | 3.8% | — | 7.6.3 | 7.4.8 | 7.2.12 | — | — |
| CVE-2025-59718KEV Yayım 2025-12-09A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0… | 9.1 | 68.3% | — | 7.6.4 | 7.4.9 | 7.2.12 | 7.0.18 | — |
| CVE-2025-24472KEV Yayım 2025-02-11An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated… | 8.1 | 7.2% | — | — | — | — | 7.0.17 | — |
| CVE-2024-55591KEV Yayım 2025-01-14An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote… | 9.6 | 94.3% | — | — | — | — | 7.0.17 | — |
| CVE-2024-23113KEV Yayım 2024-02-15A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through… | 9.8 | 61.7% | — | — | 7.4.3 | 7.2.7 | 7.0.14 | — |
| CVE-2024-21762KEV Yayım 2024-02-09A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiProxy versions 7.4.0 through… | 9.6 | 83.4% | — | — | 7.4.3 | 7.2.7 | 7.0.14 | 6.4.15 |
| CVE-2023-27997KEV Yayım 2023-06-13A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version… | 9.2 | 85.7% | — | — | — | 7.2.5 | 7.0.12 | 6.4.13 |
| CVE-2022-41328KEV Yayım 2023-03-07A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 through 7.2.3, 7.0.0 through 7.0.9 and before 6.4.11 allows a privileged… | 6.5 | 10.7% | — | — | — | 7.2.4 | 7.0.10 | 6.4.12 |
| CVE-2022-42475KEV Yayım 2023-01-02A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through… | 9.3 | 99.5% | — | — | — | 7.2.3 | 7.0.9 | 6.4.11 |
| CVE-2022-40684KEV Yayım 2022-10-18An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and… | 9.8 | 100.0% | — | — | — | 7.2.2 | 7.0.7 | — |
| CVE-2021-44168KEV Yayım 2022-01-04A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attacker to download arbitrary files on the device via… | 3.3 | 0.9% | — | — | — | — | 7.0.3 | yama yok |
| CVE-2020-12812KEV Yayım 2020-07-24An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of… | — | 45.4% | — | — | — | — | — | 6.4.1 |
| CVE-2026-106175 Yayım 2026-10-13A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.7, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiProxy 7.6.0 through 7.6.6, FortiProxy 7.4 all versions, FortiProxy… | 2.1 | 0.1% | — | 7.6.8 | 7.4.13 | 7.2.14 | yama yok | — |
| CVE-2026-84393 Yayım 2026-09-08A improper validation of certificate with host mismatch vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6, FortiProxy 7.6.2 through 7.6.6 may allow attacker to information disclosure via | 7.3 | 0.3% | — | 7.6.7 | — | — | — | — |
| CVE-2026-84392 Yayım 2026-09-08A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM 1.9.0, FortiPAM 1.8 all versions, FortiPAM 1.7 all versions, FortiPAM 1.6 all… | 2.5 | 1.1% | — | — | 7.4.13 | 7.2.14 | yama yok | yama yok |
| CVE-2026-71408 Yayım 2026-08-12A allocation of resources without limits or throttling vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4 all versions, FortiOS 7.2 all versions may allow attacker to denial of service via | 5 | 0.4% | — | 7.6.7 | 7.4.13 | 7.2.14 | yama yok | yama yok |
| CVE-2026-71407 Yayım 2026-08-12A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6 may allow an unauthenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or… | 5.1 | 0.5% | — | 7.6.7 | — | — | — | — |
| CVE-2026-59840 Yayım 2026-07-14A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.5,… | 4.1 | 0.3% | — | 7.6.4 | 7.4.9 | 7.2.14 | yama yok | yama yok |
| CVE-2026-59839 Yayım 2026-07-14A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions,… | 5 | 0.3% | — | 7.6.7 | 7.4.10 | 7.2.14 | yama yok | yama yok |
| CVE-2026-59837 Yayım 2026-07-14A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2 all versions, FortiPAM 1.8.0 through 1.8.2, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5 all… | 5.9 | 0.7% | — | — | 7.4.2 | 7.2.14 | yama yok | yama yok |
| CVE-2026-23573 Yayım 2026-07-14An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4 all versions, FortiOS 7.2 all… | 6.1 | 0.4% | — | 7.6.7 | 7.4.13 | 7.2.14 | yama yok | yama yok |
| CVE-2025-62826 Yayım 2026-07-14An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4 all versions, FortiOS 7.2 all… | 3.1 | 0.4% | — | 7.6.3 | 7.4.9 | 7.2.14 | yama yok | yama yok |
| CVE-2025-62675 Yayım 2026-07-14An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4 all versions, FortiOS 7.2 all… | 3.4 | 0.3% | — | 7.6.5 | 7.4.13 | 7.2.14 | yama yok | yama yok |
| CVE-2025-43892 Yayım 2026-07-14A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow an authenticated remote… | 4.1 | 0.4% | — | — | 7.4.4 | 7.2.14 | yama yok | — |
| CVE-2025-67862 Yayım 2026-06-09An Internal Asset Exposed to Unsafe Debug Access Level or State vulnerability [CWE-1244] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.2, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2.0 through 7.2.10, FortiOS 7.0.0… | 6 | 0.1% | — | 7.6.2 | 7.4.7 | 7.2.11 | 7.0.17 | yama yok |
| CVE-2025-53844 Yayım 2026-05-12A out-of-bounds write vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11 allows attacker to execute unauthorized code or commands via specially crafted… | 8.3 | 0.6% | — | 7.6.4 | 7.4.9 | 7.2.12 | 7.0.18 | yama yok |
| CVE-2025-53847 Yayım 2026-04-14A missing authentication for critical function vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions,… | 6.2 | 0.3% | — | 7.6.4 | 7.4.9 | 7.2.12 | 7.0.18 | yama yok |
| CVE-2026-22153 Yayım 2026-02-10An Authentication Bypass by Primary Weakness vulnerability [CWE-305] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4 may allow an unauthenticated attacker to bypass LDAP authentication of Agentless VPN or FSSO… | 7.5 | 0.8% | — | 7.6.5 | — | — | — | — |
| CVE-2025-64157 Yayım 2026-02-10A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0 all versions allows an authenticated admin to… | 6.7 | 1.5% | — | 7.6.5 | 7.4.10 | 7.2.12 | yama yok | — |
| CVE-2025-62439 Yayım 2026-02-10An Improper Verification of Source of a Communication Channel vulnerability [CWE-940] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all… | 3.8 | 0.2% | — | 7.6.5 | 7.4.10 | 7.2.14 | yama yok | — |
| CVE-2025-55018 Yayım 2026-02-10An inconsistent interpretation of http requests ('http request smuggling') vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4.3… | 5.2 | 0.4% | — | 7.6.1 | 7.4.10 | 7.2.14 | yama yok | yama yok |
| CVE-2026-25815 Yayım 2026-02-05Fortinet FortiOS through 7.6.6 allows attackers to decrypt LDAP credentials stored in device configuration files, as exploited in the wild from 2025-12-16 through 2026 (by default, the encryption key is the same… | 3.2 | 0.1% | — | 7.6.7 | yama yok | yama yok | yama yok | yama yok |
| CVE-2024-40593 Yayım 2025-12-11A key management errors vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.2, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all versions, FortiManager 7.4.0 through… | 5.9 | 0.1% | — | 7.6.1 | 7.4.5 | 7.2.8 | 7.0.15 | — |
| CVE-2025-62631 Yayım 2025-12-09An insufficient session expiration vulnerability [CWE-613] vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to maintain access to… | 5.3 | 0.3% | — | — | 7.4.1 | 7.2.14 | yama yok | yama yok |
| CVE-2024-47570 Yayım 2025-12-09An insertion of sensitive information into log file vulnerability [CWE-532] in FortiOS 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0 all versions; FortiProxy 7.4.0 through 7.4.3, 7.2.0 through 7.2.11; FortiPAM 1.4… | 6.3 | 0.4% | — | — | 7.4.4 | 7.2.8 | 7.0.19 | — |
| CVE-2025-58413 Yayım 2025-11-18A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS 6.2 all… | 6.9 | 0.4% | — | 7.6.4 | 7.4.9 | 7.2.13 | 7.0.19 | yama yok |
| CVE-2025-54821 Yayım 2025-11-18An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.11, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all… | 1.7 | 0.2% | — | 7.6.4 | 7.4.12 | 7.2.14 | yama yok | yama yok |
| CVE-2025-53843 Yayım 2025-11-18A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to… | 6.9 | 0.7% | — | 7.6.4 | 7.4.9 | 7.2.13 | 7.0.19 | yama yok |
| CVE-2025-58903 Yayım 2025-10-14An Unchecked Return Value vulnerability [CWE-252] in Fortinet FortiOS version 7.6.0 through 7.6.3 and before 7.4.8 API allows an authenticated user to cause a Null Pointer Dereference, crashing the http daemon via a… | 2.5 | 0.6% | — | 7.6.4 | 7.4.9 | 7.2.13 | 7.0.19 | yama yok |
| CVE-2025-58325 Yayım 2025-10-14An Incorrect Provision of Specified Functionality vulnerability [CWE-684] in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2.5 through 7.2.10, 7.0.0 through 7.0.15, 6.4 all versions may allow a local authenticated attacker… | 7.8 | 0.3% | — | 7.6.1 | 7.4.6 | 7.2.11 | 7.0.16 | yama yok |
| CVE-2025-57740 Yayım 2025-10-14An Heap-based Buffer Overflow vulnerability [CWE-122] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions; FortiPAM version 1.5.0, version 1.4.2… | 6.7 | 0.7% | — | 7.6.3 | 7.4.8 | 7.2.11 | 7.0.19 | yama yok |
| CVE-2025-54822 Yayım 2025-10-14An improper authorization vulnerability [CWE-285] vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.8, FortiOS 7.0.0 through 7.0.11, FortiProxy 7.4.0 through 7.4.8, FortiProxy 7.2 all… | 4.2 | 0.3% | — | — | 7.4.2 | 7.2.9 | 7.0.12 | — |
| CVE-2025-47890 Yayım 2025-10-14An URL Redirection to Untrusted Site vulnerabilities [CWE-601] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all… | 2.5 | 0.3% | — | 7.6.3 | 7.4.9 | 7.2.14 | yama yok | yama yok |
| CVE-2025-31514 Yayım 2025-10-14A insertion of sensitive information into log file vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions,… | 2.6 | 0.4% | — | 7.6.3 | 7.4.12 | 7.2.14 | yama yok | yama yok |
| CVE-2025-31366 Yayım 2025-10-14An Improper Neutralization of Input During Web Page Generation vulnerability [CWE-79] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all… | 4.5 | 0.4% | — | 7.6.3 | 7.4.8 | 7.2.14 | yama yok | yama yok |
| CVE-2025-25255 Yayım 2025-10-14An Improperly Implemented Security Check for Standard vulnerability [CWE-358] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all… | 4.8 | 0.4% | — | 7.6.4 | — | — | — | — |
| CVE-2025-25253 Yayım 2025-10-14An Improper Validation of Certificate with Host Mismatch vulnerability [CWE-297] in FortiProxy version 7.6.1 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions and FortiOS version 7.6.2 and below,… | 6.8 | 0.1% | — | 7.6.3 | 7.4.9 | 7.2.13 | 7.0.19 | — |
| CVE-2025-25252 Yayım 2025-10-14An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4 all versions may allow a remote attacker (e.g. a… | 4.3 | 0.3% | — | 7.6.3 | 7.4.7 | 7.2.11 | 7.0.17 | yama yok |
| CVE-2025-22258 Yayım 2025-10-14A heap-based buffer overflow in Fortinet FortiSRA 1.5.0, 1.4.0 through 1.4.2, FortiPAM 1.5.0, 1.4.0 through 1.4.2, 1.3.0 through 1.3.1, 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiProxy 7.6.0 through 7.6.1,… | 5.7 | 0.6% | — | 7.6.3 | 7.4.7 | 7.2.11 | 7.0.17 | — |
| CVE-2024-50571 Yayım 2025-10-14A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.0 through 7.4.5, FortiAnalyzer 7.2.0 through 7.2.9, FortiAnalyzer 7.0.0 through 7.0.13, FortiAnalyzer 6.4… | 6.5 | 0.5% | — | 7.6.1 | 7.4.6 | 7.2.11 | 7.0.17 | 6.4.16 |
| CVE-2024-47569 Yayım 2025-10-14A insertion of sensitive information into sent data vulnerability in Fortinet FortiMail 7.4.0 through 7.4.2, FortiMail 7.2.0 through 7.2.6, FortiMail 7.0 all versions, FortiManager 7.6.0 through 7.6.1, FortiManager… | 4.2 | 0.5% | — | 7.6.1 | 7.4.5 | 7.2.9 | 7.0.16 | 6.4.16 |
| CVE-2024-26008 Yayım 2025-10-14An improper check or handling of exceptional conditions vulnerability [CWE-703] in FortiOS version 7.4.0 through 7.4.3 and before 7.2.7, FortiProxy version 7.4.0 through 7.4.3 and before 7.2.9, FortiPAM before 1.2.0… | 5 | 0.6% | — | — | 7.4.4 | 7.2.8 | 7.0.19 | yama yok |
| CVE-2023-46718 Yayım 2025-10-14A stack-based buffer overflow in Fortinet FortiOS version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.7 and 7.0.0 through 7.0.12 and 6.4.6 through 6.4.15 and 6.2.9 through 6.2.16 and 6.0.13 through 6.0.18 allows… | 6.3 | 0.2% | — | — | 7.4.2 | 7.2.12 | 7.0.19 | yama yok |
| CVE-2025-22862 Yayım 2025-10-02An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiOS 7.4.0 through 7.4.7, 7.2.0 through 7.2.11, 7.0.6 and above; and FortiProxy 7.6.0 through 7.6.2, 7.4.0 through 7.4.8, 7.2… | 6.3 | 0.3% | — | — | 7.4.8 | 7.2.12 | 7.0.19 | — |
| CVE-2025-53744 Yayım 2025-08-12An incorrect privilege assignment vulnerability [CWE-266] in FortiOS Security Fabric version 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, 7.2 all versions, 7.0 all versions, 6.4 all versions, may allow a remote… | 6.8 | 0.6% | — | 7.6.3 | 7.4.8 | 7.2.12 | 7.0.18 | yama yok |
| CVE-2025-25248 Yayım 2025-08-12An Integer Overflow or Wraparound vulnerability [CWE-190] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, 7.2 all versions, 6.4 all versions, FortiProxy version 7.6.2 and below,… | 4.8 | 0.5% | — | 7.6.3 | 7.4.8 | 7.2.11 | 7.0.18 | yama yok |
| CVE-2024-26009 Yayım 2025-08-12An authentication bypass using an alternate path or channel [CWE-288] vulnerability in Fortinet FortiOS 6.4.0 through 6.4.15, FortiOS 6.2.0 through 6.2.16, FortiOS 6.0 all versions, FortiPAM 1.2.0, FortiPAM 1.1.0… | 7.9 | 0.7% | — | — | — | — | — | 6.4.16 |
| CVE-2023-45584 Yayım 2025-08-12A double free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all… | 6.3 | 0.6% | — | — | 7.4.1 | 7.2.6 | 7.0.13 | yama yok |
| CVE-2025-24477 Yayım 2025-07-15A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.2, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2.4 through 7.2.12 allows an attacker to escalate its privileges via a specially crafted CLI… | 4 | 0.2% | — | 7.6.3 | 7.4.8 | 7.2.13 | — | — |
| CVE-2024-55599 Yayım 2025-07-08An Improperly Implemented Security Check for Standard vulnerability [CWE-358] in FortiOS version 7.6.0, version 7.4.7 and below, 7.0 all versions, 6.4 all versions and FortiProxy version 7.6.1 and below, version… | 4.9 | 0.4% | — | 7.6.1 | 7.4.8 | 7.2.11 | 7.0.18 | yama yok |
| CVE-2024-52965 Yayım 2025-07-08A missing critical step in authentication vulnerability [CWE-304] in Fortinet FortiOS version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.10, and before 7.0.16 & FortiProxy version 7.6.0 through… | 6.8 | 0.3% | — | 7.6.2 | 7.4.6 | 7.2.11 | 7.0.17 | — |
| CVE-2025-25250 Yayım 2025-06-10An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS… | 3.9 | 0.5% | — | 7.6.1 | 7.4.8 | 7.2.14 | yama yok | yama yok |
| CVE-2025-24471 Yayım 2025-06-10An Improper Certificate Validation vulnerability [CWE-295] in FortiOS version 7.6.1 and below, version 7.4.7 and below may allow an EAP verified remote user to connect from FortiClient via revoked certificate. | 6 | 0.4% | — | 7.6.2 | 7.4.8 | — | — | — |
| CVE-2025-22254 Yayım 2025-06-10An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2.0 through 7.2.10, FortiOS 7.0.0 through 7.0.16, FortiOS 6.4.0… | 6.5 | 0.8% | — | 7.6.2 | 7.4.7 | 7.2.11 | 7.0.17 | 6.4.16 |
| CVE-2025-22251 Yayım 2025-06-10An improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow an unauthenticated… | 3 | 0.4% | — | 7.6.1 | 7.4.6 | 7.2.12 | 7.0.18 | yama yok |
| CVE-2024-50568 Yayım 2025-06-10A channel accessible by non-endpoint vulnerability [CWE-300] in Fortinet FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7 and before 7.0.14 & FortiProxy version 7.4.0 through 7.4.3, 7.2.0 through 7.2.9 and… | 5.6 | 0.4% | — | — | 7.4.4 | 7.2.8 | 7.0.15 | yama yok |
| CVE-2024-50562 Yayım 2025-06-10An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions may allow an attacker in possession… | 4.4 | 1.2% | — | 7.6.1 | 7.4.7 | 7.2.11 | 7.0.18 | yama yok |
| CVE-2023-29184 Yayım 2025-06-10An incomplete cleanup vulnerability [CWE-459] in FortiOS 7.2 all versions and before & FortiProxy version 7.2.0 through 7.2.2 and before 7.0.8 allows a VDOM privileged attacker to add SSH key files on the system… | 3.1 | 0.2% | — | — | — | 7.2.12 | 7.0.18 | yama yok |
| CVE-2025-47295 Yayım 2025-05-28A buffer over-read in Fortinet FortiOS versions 7.4.0 through 7.4.3, versions 7.2.0 through 7.2.7, and versions 7.0.0 through 7.0.14 may allow a remote unauthenticated attacker to crash the FGFM daemon via a… | 3.4 | 0.8% | — | — | 7.4.4 | 7.2.8 | 7.0.15 | yama yok |
| CVE-2025-47294 Yayım 2025-05-28A integer overflow or wraparound in Fortinet FortiOS versions 7.2.0 through 7.2.7, versions 7.0.0 through 7.0.14 may allow a remote unauthenticated attacker to crash the csfd daemon via a specially crafted request. | 4.8 | 0.8% | — | — | — | 7.2.8 | 7.0.15 | yama yok |
| CVE-2025-22252 Yayım 2025-05-28A missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager version 7.2.5, and FortiOS versions 7.4.4 through 7.4.6 and version 7.6.0 may allow an attacker… | 9 | 0.9% | — | 7.6.1 | 7.4.7 | — | — | — |
| CVE-2024-50565 Yayım 2025-04-08A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0.0 through 7.0.14, 6.4.0 through 6.4.15 and 6.2.0… | 3 | 0.4% | — | — | 7.4.5 | 7.2.9 | 7.0.16 | yama yok |
| CVE-2024-32122 Yayım 2025-04-08A storing passwords in a recoverable format in Fortinet FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to information disclosure via… | 2.1 | 0.2% | — | — | 7.4.9 | 7.2.13 | 7.0.19 | yama yok |
| CVE-2024-26013 Yayım 2025-04-08A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS version 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15 and… | 7.1 | 0.5% | — | — | 7.4.4 | 7.2.8 | 7.0.15 | 6.4.16 |
| CVE-2023-25610 Yayım 2025-03-24A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.6, version 6.4.0 through 6.4.11 and version 6.2.12 and… | 9.3 | 18.3% | — | — | — | 7.2.4 | 7.0.10 | 6.4.12 |
| CVE-2019-16151 Yayım 2025-03-21An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS 6.4.1 and below, 6.2.9 and below may allow a remote unauthenticated attacker to either redirect users to malicious… | 4.7 | 0.4% | — | — | — | — | — | 6.4.2 |
| CVE-2024-26006 Yayım 2025-03-14An improper neutralization of input during web page Generation vulnerability [CWE-79] in FortiOS version 7.4.3 and below, version 7.2.7 and below, version 7.0.13 and below and FortiProxy version 7.4.3 and below,… | 6.9 | 0.6% | — | — | 7.4.4 | 7.2.8 | 7.0.14 | 6.4.16 |
| CVE-2024-45324 Yayım 2025-03-11A use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.0 through 7.4.4, version 7.2.0 through 7.2.9, version 7.0.0 through 7.0.15 and before 6.4.15, FortiProxy version 7.4.0… | 7 | 0.7% | — | — | 7.4.5 | 7.2.10 | 7.0.16 | 6.4.16 |
| CVE-2024-40591 Yayım 2025-02-11An incorrect privilege assignment vulnerability [CWE-266] in Fortinet FortiOS version 7.6.0, 7.4.0 through 7.4.4, 7.2.0 through 7.2.9 and before 7.0.15 allows an authenticated admin whose access profile has the… | 8 | 0.6% | — | 7.6.1 | 7.4.5 | 7.2.10 | 7.0.16 | 6.4.16 |
| CVE-2024-35279 Yayım 2025-02-11A stack-based buffer overflow [CWE-121] vulnerability in Fortinet FortiOS version 7.2.4 through 7.2.8 and version 7.4.0 through 7.4.4 allows a remote unauthenticated attacker to execute arbitrary code or commands via… | 7.7 | 1.0% | — | — | 7.4.5 | 7.2.9 | — | — |
| CVE-2024-54021 Yayım 2025-01-14An Improper Neutralization of CRLF Sequences in HTTP Headers ('http response splitting') vulnerability [CWE-113] in Fortinet FortiOS 7.2.0 through 7.6.0, FortiProxy 7.2.0 through 7.4.5 may allow a remote… | 6.4 | 0.8% | — | 7.6.1 | 7.4.5 | 7.2.9 | — | — |
| CVE-2024-52963 Yayım 2025-01-14A out-of-bounds write in Fortinet FortiOS versions 7.6.0, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4.0 through 6.4.15 allows attacker to trigger a denial of service via specially crafted… | 3.5 | 0.8% | — | 7.6.1 | 7.4.7 | 7.2.11 | 7.0.17 | 6.4.16 |
| CVE-2024-48886 Yayım 2025-01-14A weak authentication in Fortinet FortiOS versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, FortiProxy versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.10, 7.0.0 through… | 8 | 0.5% | — | — | 7.4.5 | 7.2.9 | 7.0.16 | 6.4.16 |
| CVE-2024-48884 Yayım 2025-01-14A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.1 through 7.4.3, FortiManager Cloud 7.4.1 through 7.4.3,… | 7.1 | 15.2% | — | 7.6.1 | 7.4.5 | 7.2.10 | 7.0.16 | 6.4.16 |
| CVE-2024-46670 Yayım 2025-01-14An Out-of-bounds Read vulnerability [CWE-125] in FortiOS version 7.6.0, version 7.4.4 and below, version 7.2.9 and below and FortiSASE FortiOS tenant version 24.3.b IPsec IKE service may allow an unauthenticated… | 7.5 | 0.6% | — | 7.6.1 | 7.4.5 | 7.2.10 | — | — |
| CVE-2024-46669 Yayım 2025-01-14An Integer Overflow or Wraparound vulnerability [CWE-190] in version 7.4.4 and below, version 7.2.10 and below; FortiSASE version 23.4.b FortiOS tenant IPsec IKE service may allow an authenticated attacker to crash… | 3.2 | 0.6% | — | — | 7.4.5 | 7.2.12 | — | — |
| CVE-2024-46668 Yayım 2025-01-14An allocation of resources without limits or throttling vulnerability [CWE-770] in FortiOS versions 7.4.0 through 7.4.4, versions 7.2.0 through 7.2.8, versions 7.0.0 through 7.0.15, and versions 6.4.0 through 6.4.15… | 7.1 | 1.0% | — | — | 7.4.5 | 7.2.9 | 7.0.16 | 6.4.16 |
| CVE-2024-46666 Yayım 2025-01-14An allocation of resources without limits or throttling [CWE-770] vulnerability in FortiOS versions 7.6.0, versions 7.4.4 through 7.4.0, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow a remote… | 4.8 | 0.7% | — | 7.6.1 | 7.4.5 | 7.2.11 | 7.0.17 | 6.4.16 |
| CVE-2024-46665 Yayım 2025-01-14An insertion of sensitive information into sent data vulnerability [CWE-201] in FortiOS 7.6.0, 7.4.0 through 7.4.4 may allow an attacker in a man-in-the-middle position to retrieve the RADIUS accounting server shared… | 3.5 | 0.5% | — | 7.6.1 | 7.4.5 | — | — | — |
| CVE-2024-36504 Yayım 2025-01-14An out-of-bounds read vulnerability [CWE-125] in FortiOS SSLVPN web portal versions 7.4.0 through 7.4.4, versions 7.2.0 through 7.2.8, 7.0 all verisons, and 6.4 all versions may allow an authenticated attacker to… | 6.2 | 0.7% | — | — | 7.4.5 | 7.2.9 | 7.0.17 | 6.4.16 |
| CVE-2023-46715 Yayım 2025-01-14An origin validation error [CWE-346] vulnerability in Fortinet FortiOS IPSec VPN version 7.4.0 through 7.4.1 and version 7.2.6 and below allows an authenticated IPSec VPN user with dynamic IP addressing to send (but… | 4.7 | 0.9% | — | — | 7.4.2 | 7.2.11 | 7.0.17 | 6.4.16 |
| CVE-2023-42786 Yayım 2025-01-14A null pointer dereference in FortiOS versions 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0 all versions, 6.4 all versions , 6.2 all versions and 6.0 all versions allows attacker to trigger a denial of service via a… | 6.4 | 0.9% | — | — | 7.4.2 | 7.2.6 | 7.0.17 | 6.4.16 |
| CVE-2023-42785 Yayım 2025-01-14A null pointer dereference in FortiOS versions 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0 all versions, 6.4 all versions , 6.2 all versions and 6.0 all versions allows attacker to trigger a denial of service via a… | 6.4 | 0.7% | — | — | 7.4.2 | 7.2.6 | 7.0.17 | 6.4.16 |
| CVE-2024-33510 Yayım 2024-11-12An improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability [CWE-74] in FortiOS version 7.4.3 and below, version 7.2.8 and below, version 7.0.16 and below;… | 3.6 | 0.6% | — | — | 7.4.4 | 7.2.9 | 7.0.17 | — |
| CVE-2024-26011 Yayım 2024-11-12A missing authentication for critical function in Fortinet FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.14, FortiPAM version 1.2.0, 1.1.0 through 1.1.2, 1.0.0… | 5.2 | 0.6% | — | — | 7.4.4 | 7.2.8 | 7.0.15 | 6.4.16 |
| CVE-2023-50176 Yayım 2024-11-12A session fixation vulnerability in Fortinet FortiOS 7.4.0 through 7.4.3, FortiOS 7.2.0 through 7.2.7, FortiOS 7.0.0 through 7.0.13 allows attacker to execute unauthorized code or commands via phishing SAML… | 4 | 0.4% | — | — | 7.4.4 | 7.2.8 | 7.0.14 | — |
| CVE-2024-36505 Yayım 2024-08-13An improper access control vulnerability [CWE-284] in FortiOS 7.4.0 through 7.4.3, 7.2.5 through 7.2.7, 7.0.12 through 7.0.14 and 6.4.x may allow an attacker who has already successfully obtained write access to the… | 4.7 | 0.2% | — | — | 7.4.4 | 7.2.8 | 7.0.15 | 6.4.16 |
| CVE-2022-45862 Yayım 2024-08-13An insufficient session expiration vulnerability [CWE-613] vulnerability in FortiOS 7.2.5 and below, 7.0 all versions, 6.4 all versions; FortiProxy 7.2 all versions, 7.0 all versions; FortiPAM 1.3 all versions, 1.2… | 3.5 | 0.4% | — | — | — | 7.2.6 | 7.0.8 | 6.4.12 |
| CVE-2024-26015 Yayım 2024-07-09An incorrect parsing of numbers with different radices vulnerability [CWE-1389] in FortiProxy version 7.4.3 and below, version 7.2.10 and below, version 7.0.17 and below and FortiOS version 7.4.3 and below, version… | 3.1 | 0.5% | — | — | 7.4.4 | 7.2.9 | 7.0.16 | — |
| CVE-2024-26010 Yayım 2024-06-11A stack-based buffer overflow in Fortinet FortiPAM version 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiWeb, FortiAuthenticator, FortiSwitchManager version 7.2.0 through 7.2.3, 7.0.1 through 7.0.3, FortiOS… | 6.7 | 0.8% | — | — | 7.4.4 | 7.2.8 | 7.0.15 | 6.4.16 |
| CVE-2024-23111 Yayım 2024-06-11An improper neutralization of input during web page Generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions and FortiProxy version 7.4.2 and… | 6.2 | 1.0% | — | — | 7.4.3 | 7.2.7 | 7.0.14 | — |
| CVE-2024-23110 Yayım 2024-06-11A stack-based buffer overflow in Fortinet FortiOS version 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0 all versions allows attacker to execute… | 7.4 | 0.3% | — | — | 7.4.3 | 7.2.7 | 7.0.14 | 6.4.15 |
| CVE-2024-21754 Yayım 2024-06-11A use of password hash with insufficient computational effort vulnerability [CWE-916] affecting FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 6.4 all versions and FortiProxy version 7.4.2 and… | 1.7 | 3.5% | — | — | 7.4.4 | 7.2.9 | 7.0.16 | 6.4.16 |
| CVE-2023-46720 Yayım 2024-06-11A stack-based buffer overflow in Fortinet FortiOS version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.7 and 7.0.0 through 7.0.12 and 6.4.6 through 6.4.15 and 6.2.9 through 6.2.16 and 6.0.13 through 6.0.18 allows… | 6.3 | 0.3% | — | — | 7.4.2 | 7.2.8 | 7.0.13 | 6.4.16 |
| CVE-2024-26007 Yayım 2024-05-14An improper check or handling of exceptional conditions vulnerability [CWE-703] in Fortinet FortiOS version 7.4.1 allows an unauthenticated attacker to provoke a denial of service on the administrative interface via… | 5 | 1.2% | — | — | 7.4.2 | — | — | — |
| CVE-2023-46714 Yayım 2024-05-14A stack-based buffer overflow [CWE-121] vulnerability in Fortinet FortiOS version 7.2.1 through 7.2.6 and version 7.4.0 through 7.4.1 allows a privileged attacker over the administrative interface to execute… | 6.8 | 1.4% | — | — | 7.4.2 | 7.2.7 | — | — |
| CVE-2023-45586 Yayım 2024-05-14An insufficient verification of data authenticity vulnerability [CWE-345] in Fortinet FortiOS SSL-VPN tunnel mode version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.7 and before 7.0.12 & FortiProxy SSL-VPN tunnel… | 4.7 | 0.3% | — | — | 7.4.2 | 7.2.8 | 7.0.13 | 6.4.16 |
| CVE-2023-45583 Yayım 2024-05-14A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0.0 through… | 6.5 | 0.7% | — | — | 7.4.1 | 7.2.6 | 7.0.13 | yama yok |
| CVE-2023-44247 Yayım 2024-05-14A double free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 6.4 all versions may allow a privileged attacker to execute code or commands via crafted HTTP or HTTPs requests. | 6.5 | 1.2% | — | — | — | — | — | yama yok |
| CVE-2023-36640 Yayım 2024-05-14A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0.0 through… | 6.5 | 0.3% | — | — | — | 7.2.1 | 7.0.13 | 6.4.15 |
| CVE-2024-23662 Yayım 2024-04-09An exposure of sensitive information to an unauthorized actor in Fortinet FortiOS at least version at least 7.4.0 through 7.4.1 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.15 and 6.4.0 through 6.4.15 allows… | 5 | 0.7% | — | — | 7.4.2 | 7.2.6 | 7.0.16 | 6.4.16 |
| CVE-2023-48784 Yayım 2024-04-09A use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.1 and below, version 7.2.7 and below, 7.0 all versions, 6.4 all versions command line interface may allow a local privileged… | 6.1 | 0.8% | — | — | 7.4.2 | 7.2.8 | 7.0.16 | 6.4.16 |
| CVE-2023-41677 Yayım 2024-04-09A insufficiently protected credentials in Fortinet FortiProxy 7.4.0, 7.2.0 through 7.2.6, 7.0.0 through 7.0.12, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7, Fortinet FortiOS… | 7.5 | 0.8% | — | — | 7.4.2 | 7.2.7 | 7.0.13 | 6.4.15 |
| CVE-2024-23112 Yayım 2024-03-12An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiOS version 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.1 through 7.0.13, 6.4.7 through 6.4.14, and FortiProxy version 7.4.0… | 7.2 | 0.7% | — | — | 7.4.2 | 7.2.7 | 7.0.14 | 6.4.15 |
| CVE-2023-46717 Yayım 2024-03-12An improper authentication vulnerability [CWE-287] in FortiOS versions 7.4.1 and below, versions 7.2.6 and below, and versions 7.0.12 and below when configured with FortiAuthenticator in HA may allow a readonly user… | 6.7 | 0.6% | — | — | 7.4.2 | 7.2.7 | 7.0.13 | — |
| CVE-2023-42790 Yayım 2024-03-12A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, FortiProxy… | 7.7 | 1.1% | — | — | 7.4.2 | 7.2.6 | 7.0.13 | 6.4.15 |
| CVE-2023-42789 Yayım 2024-03-12A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, FortiProxy 7.4.0,… | 9.3 | 3.3% | — | — | 7.4.2 | 7.2.6 | 7.0.13 | 6.4.15 |
| CVE-2023-29181 Yayım 2024-02-22A use of externally-controlled format string in Fortinet FortiOS 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.14, 6.0.0 through 6.0.16, FortiProxy 7.2.0 through 7.2.4, 7.0.0… | 8.3 | 0.7% | — | — | — | 7.2.5 | 7.0.12 | 6.4.13 |
| CVE-2023-29180 Yayım 2024-02-22A null pointer dereference in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.14, 6.0.0 through 6.0.16, FortiProxy 7.2.0 through 7.2.3, 7.0.0 through… | 7.3 | 2.6% | — | — | — | 7.2.5 | 7.0.12 | 6.4.13 |
| CVE-2023-29179 Yayım 2024-02-22A null pointer dereference in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, Fortiproxy version 7.2.0 through 7.2.4, 7.0.0 through 7.0.10 allows attacker to denial of… | 6.4 | 2.5% | — | — | — | 7.2.5 | 7.0.12 | 6.4.13 |
| CVE-2023-47537 Yayım 2024-02-15An improper certificate validation vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.15, FortiOS 6.4 all versions allows a remote and unauthenticated… | 4.4 | 0.2% | — | — | 7.4.2 | 7.2.7 | 7.0.16 | yama yok |
| CVE-2023-44250 Yayım 2024-01-10An improper privilege management vulnerability [CWE-269] in a Fortinet FortiOS HA cluster version 7.4.0 through 7.4.1 and 7.2.5 and in a FortiProxy HA cluster version 7.4.0 through 7.4.1 allows an authenticated… | 8.3 | 0.9% | — | — | 7.4.2 | 7.2.6 | — | — |
| CVE-2023-47536 Yayım 2023-12-13An improper access control vulnerability [CWE-284] in FortiOS version 7.2.0, version 7.0.13 and below, version 6.4.14 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and… | 2.8 | 0.6% | — | — | — | 7.2.1 | 7.0.14 | 6.4.15 |
| CVE-2023-41678 Yayım 2023-12-13A double free in Fortinet FortiOS versions 7.0.0 through 7.0.5, FortiPAM version 1.0.0 through 1.0.3, 1.1.0 through 1.1.1 allows attacker to execute unauthorized code or commands via specifically crafted request. | 8.3 | 1.1% | — | — | — | — | 7.0.6 | — |
| CVE-2023-36639 Yayım 2023-12-13A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, FortiOS versions 7.4.0, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0… | 7 | 1.1% | — | — | 7.4.1 | 7.2.5 | 7.0.12 | 6.4.13 |
| CVE-2023-36641 Yayım 2023-11-14A numeric truncation error in Fortinet FortiProxy version 7.2.0 through 7.2.4, FortiProxy version 7.0.0 through 7.0.10, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1, all versions,… | 6.2 | 1.3% | — | — | 7.4.1 | 7.2.6 | 7.0.13 | 6.4.15 |
| CVE-2023-28002 Yayım 2023-11-14An improper validation of integrity check value vulnerability [CWE-354] in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.12, 6.4 all versions, 6.2 all versions, 6.0 all versions and VMs may allow a local attacker… | 5.8 | 0.2% | — | — | — | 7.2.4 | 7.0.13 | 6.4.16 |
| CVE-2023-41841 Yayım 2023-10-10An improper authorization vulnerability in Fortinet FortiOS 7.0.0 - 7.0.11 and 7.2.0 - 7.2.4 allows an attacker belonging to the prof-admin profile to perform elevated actions. | 7.4 | 1.1% | — | — | — | 7.2.5 | 7.0.12 | — |
| CVE-2023-41675 Yayım 2023-10-10A use after free vulnerability [CWE-416] in FortiOS version 7.2.0 through 7.2.4 and version 7.0.0 through 7.0.10 and FortiProxy version 7.2.0 through 7.2.2 and version 7.0.0 through 7.0.8 may allow an unauthenticated… | 4.8 | 1.4% | — | — | — | 7.2.5 | 7.0.11 | — |
| CVE-2023-37935 Yayım 2023-10-10A use of GET request method with sensitive query strings vulnerability in Fortinet FortiOS 7.0.0 - 7.0.12, 7.2.0 - 7.2.5 and 7.4.0 allows an attacker to view plaintext passwords of remote services such as RDP or VNC,… | 6.5 | 1.1% | — | — | 7.4.1 | 7.2.6 | 7.0.13 | — |
| CVE-2023-36555 Yayım 2023-10-10An improper neutralization of script-related html tags in a web page (basic xss) in Fortinet FortiOS 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or commands via the SAML and Security Fabric components. | 3.9 | 0.4% | — | — | — | 7.2.5 | — | — |
| CVE-2023-33301 Yayım 2023-10-10An improper access control vulnerability in Fortinet FortiOS 7.2.0 - 7.2.4 and 7.4.0 allows an attacker to access a restricted resource from a non trusted host. | 6.5 | 0.6% | — | — | 7.4.1 | 7.2.5 | — | — |
| CVE-2023-29183 Yayım 2023-09-13An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiProxy 7.2.0 through 7.2.4, 7.0.0 through 7.0.10 and FortiOS 7.2.0 through 7.2.4, 7.0.0 through… | 7.3 | 1.3% | — | — | — | 7.2.5 | 7.0.12 | 6.4.13 |
| CVE-2023-29182 Yayım 2023-08-17A stack-based buffer overflow vulnerability [CWE-121] in Fortinet FortiOS before 7.0.3 allows a privileged attacker to execute arbitrary code via specially crafted CLI commands, provided the attacker were able to… | 6.4 | 0.3% | — | — | — | — | 7.0.4 | 6.4.15 |
| CVE-2023-33308 Yayım 2023-07-26A stack-based overflow vulnerability [CWE-124] in Fortinet FortiOS version 7.0.0 through 7.0.10 and 7.2.0 through 7.2.3 and FortiProxy version 7.0.0 through 7.0.9 and 7.2.0 through 7.2.2 allows a remote… | 9.8 | 2.1% | — | — | — | 7.2.4 | 7.0.11 | — |
| CVE-2023-28001 Yayım 2023-07-11An insufficient session expiration in Fortinet FortiOS 7.0.0 - 7.0.12 and 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or commands via reusing the session of a deleted user in the REST API. | 4.1 | 0.5% | — | — | — | 7.2.5 | 7.0.13 | — |
| CVE-2023-33307 Yayım 2023-06-16A null pointer dereference in Fortinet FortiOS before 7.2.5 and before 7.0.11, FortiProxy before 7.2.3 and before 7.0.9 allows attacker to denial of sslvpn service via specifically crafted request in network parameter. | 6.4 | 0.6% | — | — | — | 7.2.5 | 7.0.11 | — |
| CVE-2023-33306 Yayım 2023-06-16A null pointer dereference in Fortinet FortiOS before 7.2.5, before 7.0.11 and before 6.4.13, FortiProxy before 7.2.4 and before 7.0.10 allows attacker to denial of sslvpn service via specifically crafted request in… | 6.2 | 0.8% | — | — | — | 7.2.5 | 7.0.11 | 6.4.13 |
| CVE-2023-33305 Yayım 2023-06-13A loop with unreachable exit condition ('infinite loop') in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS version 7.0.0 through 7.0.10, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all… | 4.9 | 0.8% | — | — | — | 7.2.5 | 7.0.11 | 6.4.14 |
| CVE-2023-29178 Yayım 2023-06-13A access of uninitialized pointer vulnerability [CWE-824] in Fortinet FortiProxy version 7.2.0 through 7.2.3 and before 7.0.9 and FortiOS version 7.2.0 through 7.2.4 and before 7.0.11 allows an authenticated attacker… | 4.1 | 0.9% | — | — | — | 7.2.5 | 7.0.12 | 6.4.14 |
| CVE-2023-29175 Yayım 2023-06-13An improper certificate validation vulnerability [CWE-295] in FortiOS 6.2 all versions, 6.4 all versions, 7.0.0 through 7.0.10, 7.2.0 and FortiProxy 1.2 all versions, 2.0 all versions, 7.0.0 through 7.0.9, 7.2.0… | 4.4 | 0.2% | — | — | — | 7.2.1 | 7.0.11 | yama yok |
| CVE-2023-26207 Yayım 2023-06-13An insertion of sensitive information into log file vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4 and FortiProxy 7.0.0 through 7.0.10. 7.2.0 through 7.2.1 allows an attacker to read certain passwords in plain… | 3.3 | 0.5% | — | — | — | 7.2.6 | — | — |
| CVE-2023-22639 Yayım 2023-06-13A out-of-bounds write in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.10, FortiOS version 6.4.0 through 6.4.12, FortiOS all versions 6.2, FortiOS all versions 6.0, FortiProxy… | 6.3 | 0.2% | — | — | — | 7.2.4 | 7.0.11 | 6.4.13 |
| CVE-2022-43953 Yayım 2023-06-13A use of externally-controlled format string in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS all versions 7.0, FortiOS all versions 6.4, FortiOS all versions 6.2, FortiProxy version 7.2.0 through 7.2.1,… | 6.3 | 0.2% | — | — | — | 7.2.5 | 7.0.12 | 6.4.13 |
| CVE-2022-42474 Yayım 2023-06-13A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9 and before 6.4.12, FortiProxy version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.7,… | 6.2 | 0.6% | — | — | — | 7.2.4 | 7.0.10 | 6.4.13 |
| CVE-2022-41327 Yayım 2023-06-13A cleartext transmission of sensitive information vulnerability [CWE-319] in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.8, FortiProxy version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.8 allows an… | 7.6 | 0.1% | — | — | — | 7.2.4 | 7.0.9 | — |
| CVE-2023-22640 Yayım 2023-05-03A out-of-bounds write in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.10, FortiOS version 6.4.0 through 6.4.11, FortiOS version 6.2.0 through 6.2.13, FortiOS all versions 6.0,… | 7.1 | 0.9% | — | — | — | 7.2.4 | 7.0.11 | 6.4.12 |
| CVE-2023-22641 Yayım 2023-04-11A url redirection to untrusted site ('open redirect') in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.9, FortiOS versions 6.4.0 through 6.4.12, FortiOS all versions 6.2, FortiOS all… | 4.1 | 0.3% | — | — | — | 7.2.4 | 7.0.10 | 6.4.13 |
| CVE-2022-43947 Yayım 2023-04-11An improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiOS version 7.2.0 through 7.2.3 and before 7.0.10, FortiProxy version 7.2.0 through 7.2.2 and before 7.0.8… | 4.7 | 0.4% | — | — | — | 7.2.4 | 7.0.11 | 6.4.13 |
| CVE-2022-41330 Yayım 2023-04-11An improper neutralization of input during web page generation vulnerability ('Cross-site Scripting') [CWE-79] in Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9, version 6.4.0 through… | 8.3 | 0.6% | — | — | — | 7.2.4 | 7.0.10 | 6.4.12 |
| CVE-2022-45861 Yayım 2023-03-07An access of uninitialized pointer vulnerability [CWE-824] in the SSL VPN portal of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9 and before 6.4.11 and FortiProxy version 7.2.0 through… | 6.4 | 0.8% | — | — | — | 7.2.4 | 7.0.10 | 6.4.12 |
| CVE-2022-42476 Yayım 2023-03-07A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.11, FortiProxy version 7.2.0 through 7.2.2 and 7.0.0 through 7.0.8 allows… | 7.8 | 0.2% | — | — | — | 7.2.4 | 7.0.9 | 6.4.12 |
| CVE-2022-41329 Yayım 2023-03-07An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in Fortinet FortiProxy version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.7, FortiOS version 7.2.0 through 7.2.3 and 7.0.0 through… | 5.2 | 0.6% | — | — | — | 7.2.4 | 7.0.10 | 6.4.13 |
| CVE-2022-42472 Yayım 2023-02-16A improper neutralization of crlf sequences in http headers ('http response splitting') in Fortinet FortiOS versions 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.11, 6.2.0 through 6.2.12, 6.0.0 through… | 4 | 0.5% | — | — | — | 7.2.3 | 7.0.9 | 6.4.12 |
| CVE-2022-41335 Yayım 2023-02-16A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.10, FortiProxy version 7.2.0 through 7.2.1, 7.0.0 through 7.0.7 and before 2.0.10,… | 8.6 | 0.9% | — | — | — | 7.2.3 | 7.0.9 | 6.4.12 |
| CVE-2022-41334 Yayım 2023-02-16An improper neutralization of input during web page generation [CWE-79] vulnerability in FortiOS versions 7.0.0 to 7.0.7 and 7.2.0 to 7.2.3 may allow a remote, unauthenticated attacker to launch a cross site… | 8.6 | 0.7% | — | — | — | 7.2.4 | 7.0.8 | — |
| CVE-2022-39948 Yayım 2023-02-16An improper certificate validation vulnerability [CWE-295] in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.7, 6.4 all versions, 6.2 all versions, 6.0 all versions and FortiProxy 7.0.0 through 7.0.6, 2.0 all… | 4.4 | 0.3% | — | — | — | 7.2.4 | 7.0.8 | 6.4.12 |
| CVE-2022-38378 Yayım 2023-02-16An improper privilege management vulnerability [CWE-269] in Fortinet FortiOS version 7.2.0 and before 7.0.7 and FortiProxy version 7.2.0 through 7.2.1 and before 7.0.7 allows an attacker that has access to the admin… | 4 | 0.2% | — | — | — | 7.2.1 | 7.0.8 | 6.4.12 |
| CVE-2022-29054 Yayım 2023-02-16A missing cryptographic steps vulnerability [CWE-325] in the functions that encrypt the DHCP and DNS keys in Fortinet FortiOS version 7.2.0, 7.0.0 through 7.0.5, 6.4.0 through 6.4.9, 6.2.x and 6.0.x may allow an… | 3.1 | 0.2% | — | — | — | 7.2.1 | 7.0.8 | 6.4.10 |
| CVE-2021-43074 Yayım 2023-02-16An improper verification of cryptographic signature vulnerability [CWE-347] in FortiWeb 6.4 all versions, 6.3.16 and below, 6.2 all versions, 6.1 all versions, 6.0 all versions; FortiOS 7.0.3 and below, 6.4.8 and… | 4.1 | 0.3% | — | — | — | — | 7.0.4 | 6.4.9 |
| CVE-2022-40680 Yayım 2022-12-06A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiOS 6.0.7 - 6.0.15, 6.2.2 - 6.2.12, 6.4.0 - 6.4.9 and 7.0.0 - 7.0.3 allows a privileged attacker to execute… | 3.8 | 0.4% | — | — | — | — | 7.0.4 | 6.4.10 |
| CVE-2022-35843 Yayım 2022-12-06An authentication bypass by assumed-immutable data vulnerability [CWE-302] in the FortiOS SSH login component 7.2.0, 7.0.0 through 7.0.7, 6.4.0 through 6.4.9, 6.2 all versions, 6.0 all versions and FortiProxy SSH… | 7.7 | 0.9% | — | — | — | 7.2.1 | 7.0.7 | 6.4.10 |
| CVE-2022-38380 Yayım 2022-11-02An improper access control [CWE-284] vulnerability in FortiOS version 7.2.0 and versions 7.0.0 through 7.0.7 may allow a remote authenticated read-only user to modify the interface settings via the API. | 4.3 | 23.0% | — | — | — | 7.2.1 | 7.0.8 | — |
| CVE-2022-35842 Yayım 2022-11-02An exposure of sensitive information to an unauthorized actor vulnerabiltiy [CWE-200] in FortiOS SSL-VPN versions 7.2.0, versions 7.0.0 through 7.0.6 and versions 6.4.0 through 6.4.9 may allow a remote… | 3.7 | 0.7% | — | — | — | 7.2.1 | 7.0.7 | 6.4.10 |
| CVE-2022-30307 Yayım 2022-11-02A key management error vulnerability [CWE-320] affecting the RSA SSH host key in FortiOS 7.2.0 and below, 7.0.6 and below, 6.4.9 and below may allow an unauthenticated attacker to perform a man in the middle attack. | 3.9 | 0.5% | — | — | — | 7.2.1 | yama yok | yama yok |
| CVE-2022-29055 Yayım 2022-10-10A access of uninitialized pointer in Fortinet FortiOS version 7.2.0, 7.0.0 through 7.0.5, 6.4.0 through 6.4.8, 6.2.0 through 6.2.10, 6.0.x, FortiProxy version 7.0.0 through 7.0.4, 2.0.0 through 2.0.9, 1.2.x allows a… | 7.5 | 1.1% | — | — | — | 7.2.1 | 7.0.6 | 6.4.10 |
| CVE-2021-44171 Yayım 2022-10-10A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiOS version 6.0.0 through 6.0.14, FortiOS version 6.2.0 through 6.2.10, FortiOS version 6.4.0 through… | 9 | 1.5% | — | — | — | — | 7.0.4 | 6.4.9 |
| CVE-2022-29053 Yayım 2022-09-06A missing cryptographic steps vulnerability [CWE-325] in the functions that encrypt the keytab files in FortiOS version 7.2.0, 7.0.0 through 7.0.5 and below 7.0.0 may allow an attacker in possession of the encrypted… | 2.3 | 0.3% | — | — | — | 7.2.1 | 7.0.6 | 6.4.10 |
| CVE-2022-27491 Yayım 2022-09-06A improper verification of source of a communication channel in Fortinet FortiOS with IPS engine version 7.201 through 7.214, 7.001 through 7.113, 6.001 through 6.121, 5.001 through 5.258 and before 4.086 allows a… | 6.8 | 1.4% | — | — | — | 7.2.1 | 7.0.6 | 6.4.10 |
| CVE-2021-43080 Yayım 2022-09-06An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS version 7.2.0, version 6.4.0 through 6.4.9, version 7.0.0 through 7.0.5 may allow an authenticated attacker to perform… | 4.6 | 0.4% | — | — | — | 7.2.1 | 7.0.6 | 6.4.10 |
| CVE-2022-22299 Yayım 2022-08-05A format string vulnerability [CWE-134] in the command line interpreter of FortiADC version 6.0.0 through 6.0.4, FortiADC version 6.1.0 through 6.1.5, FortiADC version 6.2.0 through 6.2.1, FortiProxy version 1.0.0… | 7.8 | 0.2% | — | — | — | — | ? | ? |
| CVE-2022-23442 Yayım 2022-08-03An improper access control vulnerability [CWE-284] in FortiOS versions 6.2.0 through 6.2.11, 6.4.0 through 6.4.8 and 7.0.0 through 7.0.5 may allow an authenticated attacker with a restricted user profile to gather… | 4.3 | 0.6% | — | — | — | — | 7.0.6 | 6.4.9 |
| CVE-2022-23438 Yayım 2022-07-18An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in FortiOS version 7.0.5 and prior and 6.4.9 and prior may allow an unauthenticated remote attacker to… | 4.7 | 0.7% | — | — | — | — | 7.0.6 | 6.4.10 |
| CVE-2021-44170 Yayım 2022-07-18A stack-based buffer overflow vulnerability [CWE-121] in the command line interpreter of FortiOS before 7.0.4 and FortiProxy before 2.0.8 may allow an authenticated attacker to execute unauthorized code or commands… | 6.7 | 0.2% | — | — | — | — | 7.0.4 | yama yok |
| CVE-2021-42755 Yayım 2022-07-18An integer overflow / wraparound vulnerability [CWE-190] in FortiSwitch 7.0.2 and below, 6.4.9 and below, 6.2.x, 6.0.x; FortiRecorder 6.4.2 and below, 6.0.10 and below; FortiOS 7.0.2 and below, 6.4.8 and below,… | 4.3 | 0.4% | — | — | — | — | 7.0.3 | yama yok |
| CVE-2022-22306 Yayım 2022-05-24An improper certificate validation vulnerability [CWE-295] in FortiOS 6.0.0 through 6.0.14, 6.2.0 through 6.2.10, 6.4.0 through 6.4.8, 7.0.0 may allow a network adjacent and unauthenticated attacker to… | 5.4 | 0.2% | — | — | — | — | 7.0.1 | 6.4.9 |
| CVE-2021-43206 Yayım 2022-05-04A server-generated error message containing sensitive information in Fortinet FortiOS 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.x, 6.0.x and FortiProxy 7.0.0 through 7.0.1, 2.0.x allows malicious webservers to… | 4.3 | 0.8% | — | — | — | — | 7.0.4 | 6.4.9 |
| CVE-2021-41032 Yayım 2022-05-04An improper access control vulnerability [CWE-284] in FortiOS versions 6.4.8 and prior and 7.0.3 and prior may allow an authenticated attacker with a restricted user profile to gather sensitive information and modify… | 6.3 | 0.6% | — | — | — | — | 7.0.4 | 6.4.9 |
| CVE-2021-26092 Yayım 2022-02-24Failure to sanitize input in the SSL VPN web portal of FortiOS 5.2.10 through 5.2.15, 5.4.0 through 5.4.13, 5.6.0 through 5.6.14, 6.0.0 through 6.0.12, 6.2.0 through 6.2.7, 6.4.0 through 6.4.4; and FortiProxy 1.2.0… | 4.7 | 1.1% | — | — | — | — | — | 6.4.5 |
| CVE-2021-36169 Yayım 2021-12-13A Hidden Functionality in Fortinet FortiOS 7.x before 7.0.1, FortiOS 6.4.x before 6.4.7 allows attacker to Execute unauthorized code or commands via specific hex read/write operations. | 4.2 | 0.3% | — | — | — | — | 7.0.1 | 6.4.7 |
| CVE-2021-42757 Yayım 2021-12-08A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to achieve arbitrary code execution via specially crafted… | 6.3 | 0.5% | — | — | — | — | 7.0.3 | 6.4.8 |
| CVE-2021-41024 Yayım 2021-12-08A relative path traversal [CWE-23] vulnerabiltiy in FortiOS versions 7.0.0 and 7.0.1 and FortiProxy verison 7.0.0 may allow an unauthenticated, unauthorized attacker to inject path traversal character sequences to… | 7.5 | 1.6% | — | — | — | — | 7.0.2 | — |
| CVE-2021-36173 Yayım 2021-12-08A heap-based buffer overflow in the firmware signature verification function of FortiOS versions 7.0.1, 7.0.0, 6.4.0 through 6.4.6, 6.2.0 through 6.2.9, and 6.0.0 through 6.0.13 may allow an attacker to execute… | 8 | 1.5% | — | — | — | — | 7.0.2 | 6.4.7 |
| CVE-2021-26110 Yayım 2021-12-08An improper access control vulnerability [CWE-284] in FortiOS autod daemon 7.0.0, 6.4.6 and below, 6.2.9 and below, 6.0.12 and below and FortiProxy 2.0.1 and below, 1.2.9 and below may allow an authenticated… | 7.8 | 0.3% | — | — | — | — | 7.0.1 | 6.4.7 |
| CVE-2021-26109 Yayım 2021-12-08An integer overflow or wraparound vulnerability in the memory allocator of SSLVPN in FortiOS before 7.0.1 may allow an unauthenticated attacker to corrupt control data on the heap via specifically crafted requests to… | 8.1 | 1.9% | — | — | — | — | 7.0.1 | yama yok |
| CVE-2021-26108 Yayım 2021-12-08A use of hard-coded cryptographic key vulnerability in the SSLVPN of FortiOS before 7.0.1 may allow an attacker to retrieve the key by reverse engineering. | 7.5 | 1.1% | — | — | — | — | 7.0.1 | yama yok |
| CVE-2021-32600 Yayım 2021-11-17An exposure of sensitive information to an unauthorized actor vulnerability in FortiOS CLI 7.0.0, 6.4.0 through 6.4.6, 6.2.0 through 6.2.9, 6.0.x and 5.6.x may allow a local and authenticated user assigned to a… | 5 | 0.6% | — | — | — | — | 7.0.1 | 6.4.7 |
| CVE-2021-41019 Yayım 2021-11-02An improper validation of certificate with host mismatch [CWE-297] vulnerability in FortiOS versions 6.4.6 and below may allow the connection to a malicious LDAP server via options in GUI, leading to disclosure of… | 3.5 | 0.6% | — | — | — | — | — | 6.4.7 |
| CVE-2021-24018 Yayım 2021-08-04A buffer underwrite vulnerability in the firmware verification routine of FortiOS before 7.0.1 may allow an attacker located in the adjacent network to potentially execute arbitrary code via a specifically crafted… | 4.3 | 1.0% | — | — | — | — | 7.0.1 | yama yok |
Tablo nasıl hazırlanıyor?
Build numarası ve çıkış tarihi her yamanın Fortinet sürüm notundan alınır: build, notun giriş cümlesinden, tarih değişiklik günlüğünün “Initial release” satırından. Açık verisi Fortinet’in CVE Numaralandırma Yetkilisi olarak CVE.org’a yazdığı kayıtlardan, fiilen istismar bilgisi CISA KEV kataloğundan, istismar olasılığı FIRST EPSS’ten gelir. Fortinet PSIRT sayfaları kullanılmaz.
Eşleştirme, Denetta’nın müşteri cihazlarında kullandığı fonksiyonun aynısıdır: bu sayfada bir sürüm için görünen açık, o sürümdeki bir FortiGate’in denetiminde de görünür. Sürüm aralığı okunamayan bir kayıt “açık yok” sayılmaz, “?” olarak ayrıca gösterilir. Tablo yapılandırmaya bakmaz: örneğin SSL VPN kapalıysa SSL VPN açıkları cihazınızda istismar edilemeyebilir.
FortiOS 6.4 öncesi branch’ler tabloda yoktur. CVE® kayıtları © The MITRE Corporation; CVE Kullanım Şartları geçerlidir. FortiOS ve FortiGate, Fortinet, Inc.’in markalarıdır.
FortiOS sürümleri hakkında sorular
FortiGate’imin FortiOS sürümünü ve build numarasını nasıl öğrenirim?
CLI’da get system status komutunu çalıştırın. Version: satırı model, sürüm ve build’i birlikte verir, örneğin FortiGate-60F v7.4.13,build2933. Web arayüzünde aynı bilgi Gösterge Paneli’ndeki Sistem Bilgisi kartındadır.
Hangi FortiOS sürümüne yükseltmeliyim?
Açıkları kapatmanın en kısa yolu, kullandığınız branch’in son yamasına geçmektir. Branch’in desteği bittiyse desteklenen bir branch’e geçmek gerekir. Model bazında önerilen sürüm için Fortinet’in “Recommended Release” notuna, ara adımlar için Fortinet’in yükseltme yolu aracına bakın; büyük sürüm atlamaları doğrudan yapılmaz.
“Açık” sayısı cihazımın gerçekten savunmasız olduğu anlamına mı gelir?
Hayır, yalnız sürümün etkilendiği anlamına gelir. Birçok açık belirli bir özelliğin (SSL VPN, yönetim arayüzü, belirli bir servis) açık olmasını gerektirir. Cihazınız için kesin cevap, sürümle birlikte yapılandırmaya bakan bir denetimden gelir.
KEV ne demek?
CISA’nın Bilinen İstismar Edilen Açıklar kataloğu (Known Exploited Vulnerabilities). Bir açığın KEV’de olması, saldırganların onu sahada fiilen kullandığı anlamına gelir; bu açıklar önce kapatılmalıdır.
Tablo ne sıklıkla güncellenir?
Açık verisi merkezde her gün eşitlenir; sayfa yeni bir yama yayımlandığında ve açık verisi değiştiğinde yeniden üretilir. Verinin tarihi tabloların üstünde yazar.
Bu sayfa Fortinet’in resmî kaynağı mı?
Hayır. Denetta’nın herkese açık kaynaklardan derlediği resmî olmayan bir tablodur ve Fortinet ile bağlantısı yoktur. Karar vermeden önce ilgili sürüm notunu ve Fortinet PSIRT bültenini okuyun.
FortiGate’iniz bu tabloda nerede duruyor?
Denetta cihazınızın sürümünü bu tabloyla eşleştirir, açıkları yapılandırmanızla birlikte değerlendirir ve config’inizi derinlemesine denetler. Cihaza hiçbir şey yazmaz.