Skip to main content
EVULNABLE
Home

Fortinet

CVEs currently on EVULNABLE's Priority Feed for Fortinet, and this vendor's own CISA KEV history.

CISA KEV additions over time

Weekly additions to the KEV catalog, last 26 weeks. Ransomware-linked additions are the base of each bar. Ransomware-linked as currently marked by CISA; recent weeks can rise as CISA updates entries.

20 Apr – 12 Oct; busiest week: 2 added.

Week of 2026-04-20: 0 added to KEV Week of 2026-04-27: 0 added to KEV Week of 2026-05-04: 0 added to KEV Week of 2026-05-11: 0 added to KEV Week of 2026-05-18: 0 added to KEV Week of 2026-05-25: 0 added to KEV Week of 2026-06-01: 0 added to KEV Week of 2026-06-08: 0 added to KEV Week of 2026-06-15: 0 added to KEV Week of 2026-06-22: 0 added to KEV Week of 2026-06-29: 0 added to KEV Week of 2026-07-06: 0 added to KEV Week of 2026-07-13: 2 added to KEV Week of 2026-07-20: 0 added to KEV Week of 2026-07-27: 1 added to KEV Week of 2026-08-03: 0 added to KEV Week of 2026-08-10: 0 added to KEV Week of 2026-08-17: 0 added to KEV Week of 2026-08-24: 0 added to KEV Week of 2026-08-31: 0 added to KEV Week of 2026-09-07: 1 added to KEV Week of 2026-09-14: 0 added to KEV Week of 2026-09-21: 0 added to KEV Week of 2026-09-28: 1 added to KEV Week of 2026-10-05: 0 added to KEV Week of 2026-10-12 (so far): 1 added to KEV
2
1
May
Jun
Jul
Aug
Sep
Oct
  • Not ransomware-linked
  • Ransomware-linked
  • This week (so far)
CISA KEV additions per week, last 26 weeks
Week ofAdded to KEVRansomware-linked
2026-04-2000
2026-04-2700
2026-05-0400
2026-05-1100
2026-05-1800
2026-05-2500
2026-06-0100
2026-06-0800
2026-06-1500
2026-06-2200
2026-06-2900
2026-07-0600
2026-07-1320
2026-07-2000
2026-07-2710
2026-08-0300
2026-08-1000
2026-08-1700
2026-08-2400
2026-08-3100
2026-09-0710
2026-09-1400
2026-09-2100
2026-09-2810
2026-10-0500
2026-10-12 (so far)10

In EVULNABLE's ranked feed

Showing all 32 Fortinet CVEs in EVULNABLE's ranked feed.

#1 94 Immediate CVE-2018-13379 ExigentKEV since 2021 · listed over a yearRansomwareCISA KEV Fortinet — Fortinet FortiOS SSL VPN Path Traversal Vulnerability KEV + ransomware, EPSS 99.9%

EVRS 94/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS99.9% · 99.99th pctlKEV since2021-11-03

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗
#2 94 Immediate CVE-2022-40684 ExigentKEV since 2022 · listed over a yearRansomwareCISA KEV Fortinet — Fortinet Multiple Products Authentication Bypass Vulnerability KEV + ransomware, EPSS 99.9%

EVRS 94/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS99.9% · 99.98th pctlKEV since2022-10-11

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#3 94 Immediate CVE-2022-42475 ExigentKEV since 2022 · listed over a yearRansomwareCISA KEV Fortinet — Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability KEV + ransomware, EPSS 99.5%

EVRS 94/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS99.5% · 99.94th pctlKEV since2022-12-13

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#4 93 Immediate CVE-2023-48788 ExigentKEV since 2024 · listed over a yearRansomwareCISA KEV Fortinet — Fortinet FortiClient EMS SQL Injection Vulnerability KEV + ransomware, EPSS 98.4%

EVRS 93/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS98.4% · 99.92nd pctlKEV since2024-03-25

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#5 93 Immediate CVE-2024-55591 ExigentKEV since 2025 · listed over a yearRansomwareCISA KEV Fortinet — Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability KEV + ransomware, EPSS 94.1%

EVRS 93/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS94.1% · 99.85th pctlKEV since2025-01-14

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#6 90 Immediate CVE-2023-27997 ExigentKEV since 2023 · listed over a yearRansomwareCISA KEV Fortinet — Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability KEV + ransomware, EPSS 85.7%

EVRS 90/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS85.7% · 99.72nd pctlKEV since2023-06-13

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#7 89 Immediate CVE-2024-21762 ExigentKEV since 2024 · listed over a yearRansomwareCISA KEV Fortinet — Fortinet FortiOS Out-of-Bound Write Vulnerability KEV + ransomware, EPSS 83.4%

EVRS 89/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS83.4% · 99.68th pctlKEV since2024-02-09

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#8 88 Immediate CVE-2025-25257 ExigentKEV since 2025 · listed over a yearCISA KEV Fortinet — Fortinet FortiWeb SQL Injection Vulnerability KEV, EPSS 99.8%

EVRS 88/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS99.8% · 99.96th pctlKEV since2025-07-18

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.998.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#9 88 Immediate CVE-2026-21643 ExigentCISA federal deadline · Overdue by 6 monthsCISA KEV Fortinet — Fortinet FortiClient EMS SQL Injection Vulnerability KEV, EPSS 93.9%

EVRS 88/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS93.9% · 99.84th pctlKEV since2026-04-13

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.939.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#10 88 Immediate CVE-2025-64446 ExigentCISA federal deadline · Overdue by 11 monthsCISA KEV Fortinet — Fortinet FortiWeb Path Traversal Vulnerability KEV, EPSS 92.0%

EVRS 88/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS92.0% · 99.82nd pctlKEV since2025-11-14

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.920.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#11 87 Immediate CVE-2024-47575 ExigentKEV since 2024 · listed over a yearCISA KEV Fortinet — Fortinet FortiManager Missing Authentication Vulnerability KEV, EPSS 94.8%

EVRS 87/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS94.8% · 99.86th pctlKEV since2024-10-23

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.948.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#12 86 Immediate CVE-2026-24858 CISA federal deadline · Overdue by 9 monthsCISA KEV Fortinet — Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability KEV, EPSS 85.8%

EVRS 86/100 · EVRS priority: Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS85.8% · 99.73rd pctlKEV since2026-01-27

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.858.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#13 86 Immediate CVE-2018-13382 KEV since 2022 · listed over a yearRansomwareCISA KEV Fortinet — Fortinet FortiOS and FortiProxy Improper Authorization KEV + ransomware, EPSS 81.7%

EVRS 86/100 · EVRS priority: Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS7.5 (NVD)EPSS81.7% · 99.64th pctlKEV since2022-01-10

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗
#14 85 Immediate CVE-2020-12812 ExigentKEV since 2021 · listed over a yearRansomwareCISA KEV Fortinet — Fortinet FortiOS SSL VPN Improper Authentication Vulnerability KEV + ransomware, EPSS 45.4%

EVRS 85/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS45.4% · 98.8th pctlKEV since2021-11-03

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗
#15 83 Urgent CVE-2026-25089 CISA federal deadline · Overdue by 3 monthsCISA KEV Fortinet — Fortinet FortiSandbox OS Command Injection Vulnerability KEV, EPSS 76.1%

EVRS 83/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS76.1% · 99.53rd pctlKEV since2026-07-16

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.761.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#16 81 Urgent CVE-2025-59718 CISA federal deadline · Overdue by 10 monthsCISA KEV Fortinet — Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability KEV, EPSS 68.3%

EVRS 81/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS68.3% · 99.33rd pctlKEV since2025-12-16

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.683.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#17 77 Urgent CVE-2024-23113 KEV since 2024 · listed over a yearCISA KEV Fortinet — Fortinet Multiple Products Format String Vulnerability KEV, EPSS 61.7%

EVRS 77/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS61.7% · 99.16th pctlKEV since2024-10-09

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.617.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#18 76 Urgent CVE-2026-39808 CISA federal deadline · Overdue by 3 monthsCISA KEV Fortinet — Fortinet FortiSandbox OS Command Injection Vulnerability KEV, EPSS 47.4%

EVRS 76/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS47.4% · 98.8th pctlKEV since2026-07-16

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.474.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#19 75 Urgent CVE-2025-58034 CISA federal deadline · Overdue by 11 monthsCISA KEV Fortinet — Fortinet FortiWeb OS Command Injection Vulnerability KEV, EPSS 55.6%

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS7.2 (NVD)EPSS55.6% · 99.03rd pctlKEV since2025-11-18

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.556.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#20 75 Urgent CVE-2018-13374 KEV since 2022 · listed over a yearRansomwareCISA KEV Fortinet — Fortinet FortiOS and FortiADC Improper Access Control Vulnerability KEV + ransomware, EPSS 38.1%

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS4.3 (NVD)EPSS38.1% · 98.5th pctlKEV since2022-09-08

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#21 75 Urgent CVE-2018-13383 KEV since 2022 · listed over a yearRansomwareCISA KEV Fortinet — Fortinet FortiOS and FortiProxy Out-of-bounds Write KEV + ransomware, EPSS 33.6%

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS6.5 (NVD)EPSS33.6% · 98.4th pctlKEV since2022-01-10

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗
#22 75 Urgent CVE-2025-32756 KEV since 2025 · listed over a yearCISA KEV Fortinet — Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability KEV, EPSS 30.7%

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS30.7% · 98.2nd pctlKEV since2025-05-14

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.307.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#23 75 Urgent CVE-2025-68686 CISA federal deadline · Overdue by 2 monthsCISA KEV Fortinet — Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability KEV, EPSS 29.5%, added to KEV within the last 90 days

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS5.9 (NVD)EPSS29.5% · 98.2nd pctlKEV since2026-07-27

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.295.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#24 75 Urgent CVE-2019-5591 KEV since 2021 · listed over a yearRansomwareCISA KEV Fortinet — Fortinet FortiOS Default Configuration Vulnerability KEV + ransomware, EPSS 18.6%

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS6.5 (NVD)EPSS18.6% · 97.2nd pctlKEV since2021-11-03

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗
#25 75 Urgent CVE-2022-41328 KEV since 2023 · listed over a yearCISA KEV Fortinet — Fortinet FortiOS Path Traversal Vulnerability KEV, EPSS 10.7%

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS7.1 (NVD)EPSS10.7% · 95.8th pctlKEV since2023-03-14

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.107.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#26 75 Urgent CVE-2026-35616 CISA federal deadline · Overdue by 6 monthsCISA KEV Fortinet — Fortinet FortiClient EMS Improper Access Control Vulnerability KEV, EPSS 9.1%

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS9.1% · 95.3rd pctlKEV since2026-04-06

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.091.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#27 75 Urgent CVE-2025-24472 KEV since 2025 · listed over a yearRansomwareCISA KEV Fortinet — Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability KEV + ransomware, EPSS 7.2%

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS8.1 (NVD)EPSS7.2% · 94.3rd pctlKEV since2025-03-18

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#28 75 Urgent CVE-2019-6693 KEV since 2025 · listed over a yearRansomwareCISA KEV Fortinet — Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability KEV + ransomware, EPSS 6.6%

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS6.5 (NVD)EPSS6.6% · 93.8th pctlKEV since2025-06-25

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#29 75 Urgent CVE-2025-25249 CISA federal deadline · Overdue by 35 daysCISA KEV Fortinet — Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability KEV, EPSS 3.8%, added to KEV within the last 90 days

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS3.8% · 89.9th pctlKEV since2026-09-09

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.038.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#30 75 Urgent CVE-2026-104286 CISA federal deadline · Overdue by 13 daysCISA KEV Fortinet — Fortinet FortiMail Path Traversal Vulnerability KEV, EPSS 2.2%, added to KEV within the last 30 days

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS2.2% · 82.2nd pctlKEV since2026-10-01

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.022.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#31 75 Urgent CVE-2021-44168 KEV since 2021 · listed over a yearCISA KEV Fortinet — Fortinet FortiOS Arbitrary File Download KEV, EPSS 0.9%

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS7.8 (NVD)EPSS0.9% · 57.9th pctlKEV since2021-12-10

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.009.

Full CVE pageNVD ↗CISA KEV ↗
#32 75 Urgent CVE-2025-61624 CISA federal deadline in 2 daysCISA KEV Fortinet — Fortinet Multiple Products Path Traversal Vulnerability KEV, EPSS 0.6%, added to KEV within the last 30 days

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS6.5 (NVD)EPSS0.6% · 46.6th pctlKEV since2026-10-16

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.006.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗