Vendor History
Fortinet security incident history
Updated . Data gathered daily from official public sources.
As of Oct 26, 2026, Vendor History found 32 actively exploited security flaws for Fortinet, dated Nov 3, 2021 to Oct 16, 2026. Sources checked: the California and Washington Attorney General breach lists, SEC EDGAR (Form 8-K, Item 1.05) and CISA's Known Exploited Vulnerabilities catalog.
Breach notices and SEC cyber filings
None found in the sources we check.
Got a breach letter from Fortinet? What to do when a vendor has a data breach.
Actively exploited security flaws
Flaws in Fortinet products that CISA lists as exploited by attackers. If you use an affected product, check that it's updated. What a listing means.
-
Fortinet Multiple Products Path Traversal Vulnerability (CVE-2025-61624). Added to CISA's list of security flaws known to be exploited by attackers.
-
Fortinet FortiMail Path Traversal Vulnerability (CVE-2026-104286). Added to CISA's list of security flaws known to be exploited by attackers.
-
Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability (CVE-2025-25249). Added to CISA's list of security flaws known to be exploited by attackers.
-
Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2025-68686). Added to CISA's list of security flaws known to be exploited by attackers.
-
Fortinet FortiSandbox OS Command Injection Vulnerability (CVE-2026-25089). Added to CISA's list of security flaws known to be exploited by attackers.
-
Fortinet FortiSandbox OS Command Injection Vulnerability (CVE-2026-39808). Added to CISA's list of security flaws known to be exploited by attackers.
-
Fortinet FortiClient EMS SQL Injection Vulnerability (CVE-2026-21643). Added to CISA's list of security flaws known to be exploited by attackers.
-
Fortinet FortiClient EMS Improper Access Control Vulnerability (CVE-2026-35616). Added to CISA's list of security flaws known to be exploited by attackers.
-
Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability (CVE-2026-24858). Added to CISA's list of security flaws known to be exploited by attackers.
-
Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability (CVE-2025-59718). Added to CISA's list of security flaws known to be exploited by attackers.
-
Fortinet FortiWeb OS Command Injection Vulnerability (CVE-2025-58034). Added to CISA's list of security flaws known to be exploited by attackers.
-
Fortinet FortiWeb Path Traversal Vulnerability (CVE-2025-64446). Added to CISA's list of security flaws known to be exploited by attackers.
-
Fortinet FortiWeb SQL Injection Vulnerability (CVE-2025-25257). Added to CISA's list of security flaws known to be exploited by attackers.
-
Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability (CVE-2019-6693). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.
-
Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability (CVE-2025-32756). Added to CISA's list of security flaws known to be exploited by attackers.
-
Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability (CVE-2025-24472). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.
-
Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability (CVE-2024-55591). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.
-
Fortinet FortiManager Missing Authentication Vulnerability (CVE-2024-47575). Added to CISA's list of security flaws known to be exploited by attackers.
-
Fortinet Multiple Products Format String Vulnerability (CVE-2024-23113). Added to CISA's list of security flaws known to be exploited by attackers.
-
Fortinet FortiClient EMS SQL Injection Vulnerability (CVE-2023-48788). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.
-
Fortinet FortiOS Out-of-Bound Write Vulnerability (CVE-2024-21762). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.
-
Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability (CVE-2023-27997). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.
-
Fortinet FortiOS Path Traversal Vulnerability (CVE-2022-41328). Added to CISA's list of security flaws known to be exploited by attackers.
-
Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability (CVE-2022-42475). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.
-
Fortinet Multiple Products Authentication Bypass Vulnerability (CVE-2022-40684). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.
-
Fortinet FortiOS and FortiADC Improper Access Control Vulnerability (CVE-2018-13374). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.
-
Fortinet FortiOS and FortiProxy Improper Authorization (CVE-2018-13382). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.
-
Fortinet FortiOS and FortiProxy Out-of-bounds Write (CVE-2018-13383). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.
-
Fortinet FortiOS Arbitrary File Download (CVE-2021-44168). Added to CISA's list of security flaws known to be exploited by attackers.
-
Fortinet FortiOS SSL VPN Path Traversal Vulnerability (CVE-2018-13379). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.
-
Fortinet FortiOS Default Configuration Vulnerability (CVE-2019-5591). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.
-
Fortinet FortiOS SSL VPN Improper Authentication Vulnerability (CVE-2020-12812). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.
We check: California and Washington Attorney General breach notices, SEC cyber incident filings (Form 8-K, Item 1.05) and CISA's catalog of actively exploited security flaws. An empty section means we found nothing in those sources. It does not mean nothing happened. How it works
To cite: Vendor History, "Fortinet security incident history," vendorhistory.com/vendor/fortinet, data checked Oct 26, 2026. Free to reuse under CC BY 4.0 with credit to Vendor History.