CISA KEV + NVD
Fortinet flaws exploited in the wild
24 Fortinet vulnerabilities CISA lists as used by attackers, each with when it was published, NVD’s severity score, how many days passed between NVD publication and CISA’s KEV listing, and the vendor’s advisory where CISA links one. Catalog version 2026.10.20.
In numbers
- 24 exploited flaws, listed from 3 Nov 2021 to 16 Oct 2026
- 13 used in ransomware campaigns
- 13 scored critical by NVD
- 7 days: median gap between NVD publication and the KEV listing, leaving out the 3 listed on the catalog’s first day; 12 were listed within a week
All exploited Fortinet flaws, newest first
| Vulnerability | Product | Published | Added to KEV | CVSS | Advisory |
|---|---|---|---|---|---|
| CVE-2025-61624Fortinet Multiple Products Path Traversal Vulnerability | Multiple Products | 14 Apr 2026 | 16 Oct 2026185 days later | 6.5 Medium | Vendor |
| CVE-2025-25249Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability | Multiple Products | 13 Jan 2026 | 9 Sep 2026239 days later | 9.8 Critical | Vendor |
| CVE-2025-68686Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability | FortiOS | 10 Feb 2026 | 27 Jul 2026167 days later | 5.9 Medium | Vendor |
| CVE-2026-24858Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability | Multiple Products | 27 Jan 2026 | 27 Jan 2026same day or before NVD | 9.8 Critical | Vendor |
| CVE-2025-59718Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability | Multiple Products | 9 Dec 2025 | 16 Dec 20257 days later | 9.8 Critical | Vendor |
| CVE-2025-58034Fortinet FortiWeb OS Command Injection Vulnerability | FortiWeb | 18 Nov 2025 | 18 Nov 2025same day or before NVD | 7.2 High | Vendor |
| CVE-2025-64446Fortinet FortiWeb Path Traversal Vulnerability | FortiWeb | 14 Nov 2025 | 14 Nov 2025same day or before NVD | 9.8 Critical | Vendor |
| CVE-2025-25257Fortinet FortiWeb SQL Injection Vulnerability | FortiWeb | 17 Jul 2025 | 18 Jul 20251 day later | 9.8 Critical | Vendor |
| CVE-2019-6693Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability | FortiOS | 21 Nov 2019 | 25 Jun 20252043 days laterUsed in ransomware | 6.5 Medium | Vendor |
| CVE-2025-24472Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability | FortiOS and FortiProxy | 11 Feb 2025 | 18 Mar 202535 days laterUsed in ransomware | 8.1 High | Vendor |
| CVE-2024-55591Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability | FortiOS and FortiProxy | 14 Jan 2025 | 14 Jan 2025same day or before NVDUsed in ransomware | 9.8 Critical | Vendor |
| CVE-2024-23113Fortinet Multiple Products Format String Vulnerability | Multiple Products | 15 Feb 2024 | 9 Oct 2024237 days later | 9.8 Critical | Vendor |
| CVE-2024-21762Fortinet FortiOS Out-of-Bound Write Vulnerability | FortiOS | 9 Feb 2024 | 9 Feb 2024same day or before NVDUsed in ransomware | 9.8 Critical | Vendor |
| CVE-2023-27997Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability | FortiOS and FortiProxy SSL-VPN | 13 Jun 2023 | 13 Jun 2023same day or before NVDUsed in ransomware | 9.8 Critical | Vendor |
| CVE-2022-41328Fortinet FortiOS Path Traversal Vulnerability | FortiOS | 7 Mar 2023 | 14 Mar 20237 days later | 7.1 High | Vendor |
| CVE-2022-42475Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability | FortiOS | 2 Jan 2023 | 13 Dec 2022same day or before NVDUsed in ransomware | 9.8 Critical | Vendor |
| CVE-2022-40684Fortinet Multiple Products Authentication Bypass Vulnerability | Multiple Products | 18 Oct 2022 | 11 Oct 2022same day or before NVDUsed in ransomware | 9.8 Critical | Vendor |
| CVE-2018-13374Fortinet FortiOS and FortiADC Improper Access Control Vulnerability | FortiOS and FortiADC | 22 Jan 2019 | 8 Sep 20221325 days laterUsed in ransomware | 4.3 Medium | Vendor |
| CVE-2018-13383Fortinet FortiOS and FortiProxy Out-of-bounds Write | FortiOS and FortiProxy | 29 May 2019 | 10 Jan 2022957 days laterUsed in ransomware | 6.5 Medium | — |
| CVE-2018-13382Fortinet FortiOS and FortiProxy Improper Authorization | FortiOS and FortiProxy | 4 Jun 2019 | 10 Jan 2022951 days laterUsed in ransomware | 7.5 High | — |
| CVE-2021-44168Fortinet FortiOS Arbitrary File Download | FortiOS | 4 Jan 2022 | 10 Dec 2021same day or before NVD | 7.8 High | — |
| CVE-2020-12812Fortinet FortiOS SSL VPN Improper Authentication Vulnerability | FortiOS | 24 Jul 2020 | 3 Nov 2021467 days laterUsed in ransomware | 9.8 Critical | — |
| CVE-2019-5591Fortinet FortiOS Default Configuration Vulnerability | FortiOS | 14 Aug 2020 | 3 Nov 2021446 days laterUsed in ransomware | 6.5 Medium | — |
| CVE-2018-13379Fortinet FortiOS SSL VPN Path Traversal Vulnerability | FortiOS | 4 Jun 2019 | 3 Nov 2021883 days laterUsed in ransomware | 9.8 Critical | — |
What to do
- Match the product and version on your appliance against the vendor advisory linked in the row (where none is shown, use the references on the NVD page), and install the fixed release it names.
- CISA’s required action is to apply the vendor’s updates or mitigations, or stop using the product where none exist; recent entries add CISA’s own hunt or forensic-triage steps, and end-of-life products are to be disconnected. US federal civilian agencies must act by a deadline; everyone else faces the same risk.
- Keep the management interface and the VPN portal off the public internet where you can, and restrict them to known addresses where you cannot.
- A patch does not remove an attacker who got in first. For any flaw on this list, look for the vendor’s or CISA’s guidance on signs of compromise, not just the fix.
How this list is kept
- A row appears when CISA adds the flaw to its Known Exploited Vulnerabilities catalog: attackers are using it, not just able to. The catalog is re-read every week.
- Scope is the perimeter appliance: firewalls, SSL-VPN and remote-access gateways, and the delivery controllers that terminate remote access. Email gateways, sandboxes, management consoles and endpoint tools from the same vendors are left out.
- Publication date and CVSS score are NVD’s. “Days later” counts from NVD publication to the KEV listing; “same day or before NVD” means CISA listed the flaw no later than NVD published it. The catalog began on 3 Nov 2021, so older flaws listed that day count to the catalog’s start, not to when exploitation was first reported; the medians leave them out.
- “Used in ransomware” is CISA’s own field, set when a ransomware campaign is known to have used the flaw. How the data pages are built.