FortiOS (FortiGate)

The US cybersecurity agency CISA lists these vulnerabilities in its catalog of Known Exploited Vulnerabilities. What CISA does not carry does not appear in this list — even where it is being exploited.

• CVE-2018-13379Fortinet FortiOS SSL VPN Path Traversal VulnerabilityRansomware

  9.8 critical · over the network, without login · CISA deadline was 3 May 22

• CVE-2020-12812Fortinet FortiOS SSL VPN Improper Authentication VulnerabilityRansomware

  9.8 critical · over the network, without login · CISA deadline was 3 May 22

• CVE-2022-42475Fortinet FortiOS Heap-Based Buffer Overflow VulnerabilityRansomware

  9.8 critical · over the network, without login · CISA deadline was 3 Jan 23

• CVE-2023-27997Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow VulnerabilityRansomware

  9.8 critical · over the network, without login · CISA deadline was 4 Jul 23

• CVE-2024-21762Fortinet FortiOS Out-of-Bound Write VulnerabilityRansomware

  9.8 critical · over the network, without login · CISA deadline was 16 Feb 24

• CVE-2024-55591Fortinet FortiOS and FortiProxy Authentication Bypass VulnerabilityRansomware

  9.8 critical · over the network, without login · CISA deadline was 21 Jan 25

• CVE-2025-24472Fortinet FortiOS and FortiProxy Authentication Bypass VulnerabilityRansomware

  8.1 high · over the network, without login · CISA deadline was 8 Apr 25

• CVE-2018-13382Fortinet FortiOS and FortiProxy Improper AuthorizationRansomware

  7.5 high · over the network, without login · CISA deadline was 10 Jul 22

• CVE-2019-5591Fortinet FortiOS Default Configuration VulnerabilityRansomware

  6.5 medium · from the local network, without login · CISA deadline was 3 May 22

• CVE-2018-13383Fortinet FortiOS and FortiProxy Out-of-bounds WriteRansomware

  6.5 medium · over the network, without login, needs user action · CISA deadline was 10 Jul 22

• CVE-2019-6693Fortinet FortiOS Use of Hard-Coded Credentials VulnerabilityRansomware

  6.5 medium · over the network, with a basic account · CISA deadline was 16 Jul 25

• CVE-2018-13374Fortinet FortiOS and FortiADC Improper Access Control VulnerabilityRansomware

  4.3 medium · over the network, with a basic account · CISA deadline was 29 Sept 22

• CVE-2021-44168Fortinet FortiOS Arbitrary File Download

  7.8 high · locally only, with a basic account · CISA deadline was 24 Dec 21

• CVE-2022-41328Fortinet FortiOS Path Traversal Vulnerability

  7.1 high · locally only, with a basic account · CISA deadline was 4 Apr 23

• CVE-2025-68686Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

  5.9 medium · over the network, without login · CISA deadline was 10 Aug

Source: CISA KEV. The CVE is matched to the product automatically — when in doubt, the linked NVD entry applies.