{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T16:42:00.965Z",
  "tag": {
    "id": "fortinet",
    "label": "Fortinet",
    "isStack": false,
    "url": "https://pwn.watch/t/fortinet",
    "feed": "https://pwn.watch/t/fortinet/feed.xml"
  },
  "counts": {
    "incidents": 22,
    "live": 2,
    "notFullyPatched": 0,
    "patched": 22
  },
  "incidents": [
    {
      "slug": "fortinet-multiple-products-cve-2025-61624",
      "title": "Fortinet Multiple Products: Fortinet Multiple Products Path Traversal Vulnerability",
      "url": "https://pwn.watch/i/fortinet-multiple-products-cve-2025-61624",
      "json": "https://pwn.watch/i/fortinet-multiple-products-cve-2025-61624.json",
      "status": "live",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Fortinet Multiple Products",
      "tags": [
        "fortinet",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-61624"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-10-16",
      "closedAt": null,
      "updatedAt": "2026-10-16",
      "summary": "FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands. Added to CISA KEV on 2026-10-16.",
      "xPost": null
    },
    {
      "slug": "fortimail-cve-2026-104286",
      "title": "FortiMail unauthenticated file-write zero-day CVE-2026-104286",
      "url": "https://pwn.watch/i/fortimail-cve-2026-104286",
      "json": "https://pwn.watch/i/fortimail-cve-2026-104286.json",
      "status": "live",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Fortinet FortiMail",
      "tags": [
        "fortinet",
        "zero-day",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-104286"
      ],
      "affectedVersions": [
        "7.2.0–7.2.9, 7.4.0–7.4.8, 7.6.0–7.6.6, 8.0.0–8.0.1 (migrate/upgrade per Fortinet matrix)"
      ],
      "fixedVersions": [
        "8.0.2+",
        "7.6.7+",
        "7.4.9+; 7.2.x migrate to 7.4.9+"
      ],
      "startedAt": "2026-09-30",
      "closedAt": null,
      "updatedAt": "2026-10-22T11:18:00+02:00",
      "summary": "Fortinet FortiMail CVE-2026-104286 (CVSS 9.8) is an unauthenticated arbitrary file write via path traversal / null-byte issues in Identity-Based Encryption web flows. CISA confirmed active exploitation and ordered federal mitigation; Fortinet published FG-IR-26-175 with patches and interim mitigations (disable IBE / restrict admin/webmail).",
      "xPost": null
    },
    {
      "slug": "fortinet-multiple-products-cve-2025-25249",
      "title": "Fortinet Multiple Products: Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability",
      "url": "https://pwn.watch/i/fortinet-multiple-products-cve-2025-25249",
      "json": "https://pwn.watch/i/fortinet-multiple-products-cve-2025-25249.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Fortinet Multiple Products",
      "tags": [
        "fortinet",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-25249"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-09-09",
      "closedAt": "2026-09-09",
      "updatedAt": "2026-09-09",
      "summary": "Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets. Added to CISA KEV on 2026-09-09.",
      "xPost": null
    },
    {
      "slug": "fortinet-fortios-cve-2025-68686",
      "title": "Fortinet FortiOS: Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability",
      "url": "https://pwn.watch/i/fortinet-fortios-cve-2025-68686",
      "json": "https://pwn.watch/i/fortinet-fortios-cve-2025-68686.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Fortinet FortiOS",
      "tags": [
        "fortinet",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-68686"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-07-27",
      "closedAt": "2026-07-27",
      "updatedAt": "2026-07-27",
      "summary": "Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level. Added to CISA KEV on 2026-07-27.",
      "xPost": null
    },
    {
      "slug": "fortinet-fortisandbox-cve-2026-25089",
      "title": "Fortinet FortiSandbox: Fortinet FortiSandbox OS Command Injection Vulnerability",
      "url": "https://pwn.watch/i/fortinet-fortisandbox-cve-2026-25089",
      "json": "https://pwn.watch/i/fortinet-fortisandbox-cve-2026-25089.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Fortinet FortiSandbox",
      "tags": [
        "fortinet",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2026-25089",
        "CVE-2026-39808"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-07-16",
      "closedAt": "2026-07-16",
      "updatedAt": "2026-07-16",
      "summary": "Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests. CISA added CVE-2026-25089, CVE-2026-39808 to the Known Exploited Vulnerabilities catalog on 2026-07-16 based on evidence of active exploitation.",
      "xPost": null
    },
    {
      "slug": "fortinet-forticlient-ems-cve-2026-21643",
      "title": "Fortinet FortiClient EMS: Fortinet FortiClient EMS SQL Injection Vulnerability",
      "url": "https://pwn.watch/i/fortinet-forticlient-ems-cve-2026-21643",
      "json": "https://pwn.watch/i/fortinet-forticlient-ems-cve-2026-21643.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Fortinet FortiClient EMS",
      "tags": [
        "fortinet",
        "cisa-kev",
        "sql-injection"
      ],
      "cveIds": [
        "CVE-2026-21643"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-04-13",
      "closedAt": "2026-04-13",
      "updatedAt": "2026-04-13",
      "summary": "Fortinet FortiClient EMS contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests. Added to CISA KEV on 2026-04-13.",
      "xPost": null
    },
    {
      "slug": "forticlient-ems-cve-2026-35616",
      "title": "FortiClient EMS CVE-2026-35616 exploited (CVSS 9.1)",
      "url": "https://pwn.watch/i/forticlient-ems-cve-2026-35616",
      "json": "https://pwn.watch/i/forticlient-ems-cve-2026-35616.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Fortinet FortiClient EMS",
      "tags": [
        "fortinet"
      ],
      "cveIds": [
        "CVE-2026-35616"
      ],
      "affectedVersions": [
        "7.4.5 and 7.4.6 prior to hotfix (per Fortinet)"
      ],
      "fixedVersions": [
        "Hotfix for FortiClient EMS 7.4.5 / 7.4.6"
      ],
      "startedAt": "2026-04-01",
      "closedAt": "2026-04-30",
      "updatedAt": "2026-04-30",
      "summary": "In April 2026 Fortinet observed in-the-wild exploitation of CVE-2026-35616 in FortiClient EMS, a critical privilege-escalation / unauthenticated code-execution flaw (CVSS 9.1), and released an emergency weekend hotfix for EMS 7.4.5 and 7.4.6.",
      "xPost": null
    },
    {
      "slug": "fortinet-multiple-products-cve-2026-24858",
      "title": "Fortinet Multiple Products: Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability",
      "url": "https://pwn.watch/i/fortinet-multiple-products-cve-2026-24858",
      "json": "https://pwn.watch/i/fortinet-multiple-products-cve-2026-24858.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Fortinet Multiple Products",
      "tags": [
        "fortinet",
        "cisa-kev",
        "auth-bypass"
      ],
      "cveIds": [
        "CVE-2026-24858"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-01-27",
      "closedAt": "2026-01-27",
      "updatedAt": "2026-01-27",
      "summary": "Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authentication bypass using an alternate path or channel that could allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices. Added to CISA KEV on 2026-01-27.",
      "xPost": null
    },
    {
      "slug": "fortinet-multiple-products-cve-2025-59718",
      "title": "Fortinet Multiple Products: Multiple Products Improper Verification of Cryptographic Signature Vulnerability",
      "url": "https://pwn.watch/i/fortinet-multiple-products-cve-2025-59718",
      "json": "https://pwn.watch/i/fortinet-multiple-products-cve-2025-59718.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Fortinet Multiple Products",
      "tags": [
        "fortinet",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-59718"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-12-16",
      "closedAt": "2025-12-16",
      "updatedAt": "2025-12-16",
      "summary": "Fortinet FortiOS, FortiSwitchMaster, FortiProxy, and FortiWeb contain an improper verification of cryptographic signature vulnerability that may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML message. Please be aware that CVE-2025-59719 pertains to the same problem and is mentioned in the same vendor advisory. Ensure to apply all patches mentioned in the advisory. Added to CISA KEV on 2025-12-16.",
      "xPost": null
    },
    {
      "slug": "fortinet-fortiweb-cve-2025-58034",
      "title": "Fortinet FortiWeb: FortiWeb OS Command Injection Vulnerability",
      "url": "https://pwn.watch/i/fortinet-fortiweb-cve-2025-58034",
      "json": "https://pwn.watch/i/fortinet-fortiweb-cve-2025-58034.json",
      "status": "closed",
      "severity": "medium",
      "patchStatus": "patched",
      "product": "Fortinet FortiWeb",
      "tags": [
        "fortinet",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2025-58034"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-11-18",
      "closedAt": "2025-11-18",
      "updatedAt": "2025-11-18",
      "summary": "Fortinet FortiWeb contains an OS command Injection vulnerability that may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands. Added to CISA KEV on 2025-11-18.",
      "xPost": null
    },
    {
      "slug": "fortinet-fortiweb-cve-2025-64446",
      "title": "Fortinet FortiWeb: FortiWeb Path Traversal Vulnerability",
      "url": "https://pwn.watch/i/fortinet-fortiweb-cve-2025-64446",
      "json": "https://pwn.watch/i/fortinet-fortiweb-cve-2025-64446.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Fortinet FortiWeb",
      "tags": [
        "fortinet",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-64446"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-11-14",
      "closedAt": "2025-11-14",
      "updatedAt": "2025-11-14",
      "summary": "Fortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests. Added to CISA KEV on 2025-11-14.",
      "xPost": null
    },
    {
      "slug": "fortinet-fortiweb-cve-2025-25257",
      "title": "Fortinet FortiWeb: FortiWeb SQL Injection Vulnerability",
      "url": "https://pwn.watch/i/fortinet-fortiweb-cve-2025-25257",
      "json": "https://pwn.watch/i/fortinet-fortiweb-cve-2025-25257.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Fortinet FortiWeb",
      "tags": [
        "fortinet",
        "cisa-kev",
        "sql-injection"
      ],
      "cveIds": [
        "CVE-2025-25257"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-07-18",
      "closedAt": "2025-07-18",
      "updatedAt": "2025-07-18",
      "summary": "Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests. Added to CISA KEV on 2025-07-18.",
      "xPost": null
    },
    {
      "slug": "fortinet-fortios-cve-2019-6693",
      "title": "Fortinet FortiOS: FortiOS Use of Hard-Coded Credentials Vulnerability",
      "url": "https://pwn.watch/i/fortinet-fortios-cve-2019-6693",
      "json": "https://pwn.watch/i/fortinet-fortios-cve-2019-6693.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Fortinet FortiOS",
      "tags": [
        "fortinet",
        "ransomware",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2019-6693"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-06-25",
      "closedAt": "2025-06-25",
      "updatedAt": "2025-06-25",
      "summary": "Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key. Added to CISA KEV on 2025-06-25.",
      "xPost": null
    },
    {
      "slug": "fortinet-multiple-products-cve-2025-32756",
      "title": "Fortinet Multiple Products: Multiple Products Stack-Based Buffer Overflow Vulnerability",
      "url": "https://pwn.watch/i/fortinet-multiple-products-cve-2025-32756",
      "json": "https://pwn.watch/i/fortinet-multiple-products-cve-2025-32756.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Fortinet Multiple Products",
      "tags": [
        "fortinet",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-32756"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-05-14",
      "closedAt": "2025-05-14",
      "updatedAt": "2025-05-14",
      "summary": "Fortinet FortiFone, FortiVoice, FortiNDR and FortiMail contain a stack-based overflow vulnerability that may allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted HTTP requests. Added to CISA KEV on 2025-05-14.",
      "xPost": null
    },
    {
      "slug": "fortinet-fortios-and-fortiproxy-cve-2025-24472",
      "title": "Fortinet FortiOS and FortiProxy: FortiOS and FortiProxy Authentication Bypass Vulnerability",
      "url": "https://pwn.watch/i/fortinet-fortios-and-fortiproxy-cve-2025-24472",
      "json": "https://pwn.watch/i/fortinet-fortios-and-fortiproxy-cve-2025-24472.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Fortinet FortiOS and FortiProxy",
      "tags": [
        "fortinet",
        "ransomware",
        "cisa-kev",
        "auth-bypass"
      ],
      "cveIds": [
        "CVE-2025-24472"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-03-18",
      "closedAt": "2025-03-18",
      "updatedAt": "2025-03-18",
      "summary": "Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests. Added to CISA KEV on 2025-03-18.",
      "xPost": null
    },
    {
      "slug": "fortinet-fortios-and-fortiproxy-cve-2024-55591",
      "title": "Fortinet FortiOS and FortiProxy: FortiOS and FortiProxy Authentication Bypass Vulnerability",
      "url": "https://pwn.watch/i/fortinet-fortios-and-fortiproxy-cve-2024-55591",
      "json": "https://pwn.watch/i/fortinet-fortios-and-fortiproxy-cve-2024-55591.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Fortinet FortiOS and FortiProxy",
      "tags": [
        "fortinet",
        "ransomware",
        "cisa-kev",
        "auth-bypass"
      ],
      "cveIds": [
        "CVE-2024-55591"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-01-14",
      "closedAt": "2025-01-14",
      "updatedAt": "2025-01-14",
      "summary": "Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that may allow an unauthenticated, remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module. Added to CISA KEV on 2025-01-14.",
      "xPost": null
    },
    {
      "slug": "fortinet-fortimanager-fortijump-cve-2024-47575",
      "title": "FortiManager 'FortiJump' missing authentication zero-day (CVE-2024-47575)",
      "url": "https://pwn.watch/i/fortinet-fortimanager-fortijump-cve-2024-47575",
      "json": "https://pwn.watch/i/fortinet-fortimanager-fortijump-cve-2024-47575.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Fortinet FortiManager",
      "tags": [
        "fortinet",
        "fortimanager",
        "zero-day",
        "auth-bypass",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2024-47575"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-10-23",
      "closedAt": "2024-10-23",
      "updatedAt": "2024-10-23",
      "summary": "Fortinet FortiManager contains a missing authentication vulnerability in the fgfmd daemon that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests. Added to the CISA KEV catalog on 2024-10-23.",
      "xPost": null
    },
    {
      "slug": "fortinet-forticlient-ems-cve-2023-48788",
      "title": "Fortinet FortiClient EMS SQL Injection",
      "url": "https://pwn.watch/i/fortinet-forticlient-ems-cve-2023-48788",
      "json": "https://pwn.watch/i/fortinet-forticlient-ems-cve-2023-48788.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Fortinet FortiClient EMS",
      "tags": [
        "fortinet",
        "forticlient",
        "cisa-kev",
        "ransomware",
        "sql-injection"
      ],
      "cveIds": [
        "CVE-2023-48788"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-03-12",
      "closedAt": "2024-03-25",
      "updatedAt": "2024-03-25",
      "summary": "Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an unauthenticated attacker to execute commands as SYSTEM via specifically crafted requests. Added to the CISA KEV catalog on 2024-03-25. CISA lists known use in ransomware campaigns. CVE-2023-48788 was assigned before 2024; the KEV listing came in 2024.",
      "xPost": null
    },
    {
      "slug": "fortinet-multiple-products-cve-2024-23113",
      "title": "Fortinet Multiple Products Format String",
      "url": "https://pwn.watch/i/fortinet-multiple-products-cve-2024-23113",
      "json": "https://pwn.watch/i/fortinet-multiple-products-cve-2024-23113.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Fortinet Multiple Products",
      "tags": [
        "fortinet",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2024-23113"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-02-15",
      "closedAt": "2024-10-09",
      "updatedAt": "2024-10-09",
      "summary": "Fortinet FortiOS, FortiPAM, FortiProxy, and FortiWeb contain a format string vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests. Added to the CISA KEV catalog on 2024-10-09.",
      "xPost": null
    },
    {
      "slug": "fortinet-fortios-cve-2024-21762",
      "title": "Fortinet FortiOS Out-of-Bound Write",
      "url": "https://pwn.watch/i/fortinet-fortios-cve-2024-21762",
      "json": "https://pwn.watch/i/fortinet-fortios-cve-2024-21762.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Fortinet FortiOS",
      "tags": [
        "fortinet",
        "fortios",
        "cisa-kev",
        "ransomware"
      ],
      "cveIds": [
        "CVE-2024-21762"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-02-09",
      "closedAt": "2024-02-09",
      "updatedAt": "2024-02-09",
      "summary": "Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remote unauthenticated attacker to execute code or commands via specially crafted HTTP requests. Added to the CISA KEV catalog on 2024-02-09. CISA lists known use in ransomware campaigns.",
      "xPost": null
    },
    {
      "slug": "fortinet-fortios-ssl-vpn-xortigate-cve-2023-27997",
      "title": "FortiOS SSL-VPN pre-auth heap overflow (XORtigate, CVE-2023-27997)",
      "url": "https://pwn.watch/i/fortinet-fortios-ssl-vpn-xortigate-cve-2023-27997",
      "json": "https://pwn.watch/i/fortinet-fortios-ssl-vpn-xortigate-cve-2023-27997.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Fortinet FortiOS and FortiProxy SSL-VPN",
      "tags": [
        "fortinet",
        "fortios",
        "ssl-vpn",
        "rce",
        "volt-typhoon",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-27997"
      ],
      "affectedVersions": [
        "FortiOS 7.2.4 and below, 7.0.11 and below, 6.4.12 and below, 6.0.16 and below (NVD)",
        "FortiProxy 7.2.3 and below, 7.0.9 and below, 2.0.12 and below, 1.2 and 1.1 all versions (NVD)"
      ],
      "fixedVersions": [
        "See vendor advisory FG-IR-23-097"
      ],
      "startedAt": "2023-06-12",
      "closedAt": "2023-06-13",
      "updatedAt": "2023-06-13",
      "summary": "A heap overflow in the FortiOS and FortiProxy SSL-VPN allowed pre-authentication remote code execution. Fortinet said it may have been exploited in a limited number of cases, and published it alongside its analysis of the Volt Typhoon campaign.",
      "xPost": null
    },
    {
      "slug": "fortinet-fortios-cve-2022-41328",
      "title": "Fortinet FortiOS: Path Traversal (CVE-2022-41328)",
      "url": "https://pwn.watch/i/fortinet-fortios-cve-2022-41328",
      "json": "https://pwn.watch/i/fortinet-fortios-cve-2022-41328.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Fortinet FortiOS",
      "tags": [
        "fortinet",
        "cisa-kev",
        "path-traversal"
      ],
      "cveIds": [
        "CVE-2022-41328"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-03-14",
      "closedAt": "2023-03-14",
      "updatedAt": "2023-03-14",
      "summary": "Fortinet FortiOS contains a path traversal vulnerability that may allow a local privileged attacker to read and write files via crafted CLI commands. Added to CISA KEV on 2023-03-14.",
      "xPost": null
    }
  ],
  "posts": [
    {
      "authorName": "Bunker",
      "handle": "BunkerITx",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2101396047402610688/uprGaFdb_bigger.jpg",
      "text": "🚨 Fortinet FortiMail: CVE-2026-104286 (CVSS 9.8) is actively exploited.\n\nUnauthenticated attackers can write arbitrary files, potentially leading to code execution.\n\nYour email security gateway needs security. Ironic.\n\n#Cybersecurity\n\nhttps://t.co/ldmxkOOdHO https://t.co/0AYMecEQPs",
      "date": "2026-10-11T12:21:11.000Z",
      "url": "https://x.com/BunkerITx/status/2109258005313466616",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HUWW-aFXgAANCTg.jpg"
        }
      ],
      "incident": "fortimail-cve-2026-104286"
    },
    {
      "authorName": "jark after dark",
      "handle": "jarkafterdark",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2082021037404037120/UgUODE6b_bigger.jpg",
      "text": "fortinet is warning about a critical fortimail zero-day, cve-2026-104286, already under active exploitation. cisa has flagged it too.\n\nhttps://t.co/8phX4oRY7S\n\nit is an unauthenticated arbitrary file write, rated 9.8, triggered by a crafted http or https request.",
      "date": "2026-10-11T02:30:07.000Z",
      "url": "https://x.com/jarkafterdark/status/2109109259552116797",
      "media": [],
      "incident": "fortimail-cve-2026-104286"
    },
    {
      "authorName": "CiberPlaneta",
      "handle": "CiberPlanetaOrg",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2026768320549003264/1cg_XTJx_bigger.png",
      "text": "🛡️ CVE-2026-104286: escritura arbitraria de archivos en Fortinet FortiMail\nCISA confirma explotación activa de CVE-2026-104286, una falla crítica de FortiMail que permite escritura arbitraria de archivos sin autenticación.\nhttps://t.co/V275SQHfFe\n\n#ciberplaneta #vulnerabilidades",
      "date": "2026-10-01T20:58:07.000Z",
      "url": "https://x.com/CiberPlanetaOrg/status/2105764216950898840",
      "media": [],
      "incident": "fortimail-cve-2026-104286"
    }
  ],
  "changes": [
    {
      "incident": "fortinet-multiple-products-cve-2025-61624",
      "incidentTitle": "Fortinet Multiple Products: Fortinet Multiple Products Path Traversal Vulnerability",
      "severity": "high",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-16",
      "title": "CISA added CVE-2025-61624 to the KEV catalog (due 2026-10-19).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/fortinet-multiple-products-cve-2025-61624"
    },
    {
      "incident": "fortimail-cve-2026-104286",
      "incidentTitle": "FortiMail unauthenticated file-write zero-day CVE-2026-104286",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-05",
      "title": "Fortinet remediates FortiMail Cloud by updating all instances to 7.6.7 / 8.0.2 GA.",
      "body": null,
      "sourceUrl": "https://www.fortiguard.com/psirt/FG-IR-26-175",
      "url": "https://pwn.watch/i/fortimail-cve-2026-104286"
    },
    {
      "incident": "fortimail-cve-2026-104286",
      "incidentTitle": "FortiMail unauthenticated file-write zero-day CVE-2026-104286",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10",
      "title": "Fortinet PSIRT FG-IR-26-175 patches and mitigations.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/fortimail-cve-2026-104286"
    },
    {
      "incident": "fortimail-cve-2026-104286",
      "incidentTitle": "FortiMail unauthenticated file-write zero-day CVE-2026-104286",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "~2026-09-30/10-01",
      "title": "Active exploitation and CISA alerts begin circulating.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/fortimail-cve-2026-104286"
    },
    {
      "incident": "fortinet-multiple-products-cve-2025-25249",
      "incidentTitle": "Fortinet Multiple Products: Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-09-09",
      "title": "CISA added CVE-2025-25249 to the KEV catalog (due 2026-09-12).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/fortinet-multiple-products-cve-2025-25249"
    },
    {
      "incident": "fortinet-fortios-cve-2025-68686",
      "incidentTitle": "Fortinet FortiOS: Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-07-27",
      "title": "CISA added CVE-2025-68686 to the KEV catalog (due 2026-08-10).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/fortinet-fortios-cve-2025-68686"
    },
    {
      "incident": "fortinet-fortisandbox-cve-2026-25089",
      "incidentTitle": "Fortinet FortiSandbox: Fortinet FortiSandbox OS Command Injection Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-07-16",
      "title": "CISA added CVE-2026-25089, CVE-2026-39808 to the KEV catalog (due 2026-07-19).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/fortinet-fortisandbox-cve-2026-25089"
    },
    {
      "incident": "fortinet-forticlient-ems-cve-2026-21643",
      "incidentTitle": "Fortinet FortiClient EMS: Fortinet FortiClient EMS SQL Injection Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-04-13",
      "title": "CISA added CVE-2026-21643 to the KEV catalog (due 2026-04-16).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/fortinet-forticlient-ems-cve-2026-21643"
    },
    {
      "incident": "fortinet-multiple-products-cve-2026-24858",
      "incidentTitle": "Fortinet Multiple Products: Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-01-27",
      "title": "CISA added CVE-2026-24858 to the KEV catalog (due 2026-01-30).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/fortinet-multiple-products-cve-2026-24858"
    },
    {
      "incident": "fortinet-multiple-products-cve-2025-59718",
      "incidentTitle": "Fortinet Multiple Products: Multiple Products Improper Verification of Cryptographic Signature Vulnerability",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-12-16",
      "title": "CISA added CVE-2025-59718 to the KEV catalog (due 2025-12-23).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/fortinet-multiple-products-cve-2025-59718"
    },
    {
      "incident": "fortinet-fortiweb-cve-2025-58034",
      "incidentTitle": "Fortinet FortiWeb: FortiWeb OS Command Injection Vulnerability",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-11-18",
      "title": "CISA added CVE-2025-58034 to the KEV catalog (due 2025-11-25).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/fortinet-fortiweb-cve-2025-58034"
    },
    {
      "incident": "fortinet-fortiweb-cve-2025-64446",
      "incidentTitle": "Fortinet FortiWeb: FortiWeb Path Traversal Vulnerability",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-11-14",
      "title": "CISA added CVE-2025-64446 to the KEV catalog (due 2025-11-21).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/fortinet-fortiweb-cve-2025-64446"
    },
    {
      "incident": "fortinet-fortiweb-cve-2025-25257",
      "incidentTitle": "Fortinet FortiWeb: FortiWeb SQL Injection Vulnerability",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-07-18",
      "title": "CISA added CVE-2025-25257 to the KEV catalog (due 2025-08-08).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/fortinet-fortiweb-cve-2025-25257"
    },
    {
      "incident": "fortinet-fortios-cve-2019-6693",
      "incidentTitle": "Fortinet FortiOS: FortiOS Use of Hard-Coded Credentials Vulnerability",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-06-25",
      "title": "CISA added CVE-2019-6693 to the KEV catalog (due 2025-07-16).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/fortinet-fortios-cve-2019-6693"
    },
    {
      "incident": "fortinet-multiple-products-cve-2025-32756",
      "incidentTitle": "Fortinet Multiple Products: Multiple Products Stack-Based Buffer Overflow Vulnerability",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-05-14",
      "title": "CISA added CVE-2025-32756 to the KEV catalog (due 2025-06-04).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/fortinet-multiple-products-cve-2025-32756"
    },
    {
      "incident": "fortinet-fortios-and-fortiproxy-cve-2025-24472",
      "incidentTitle": "Fortinet FortiOS and FortiProxy: FortiOS and FortiProxy Authentication Bypass Vulnerability",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-03-18",
      "title": "CISA added CVE-2025-24472 to the KEV catalog (due 2025-04-08).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/fortinet-fortios-and-fortiproxy-cve-2025-24472"
    },
    {
      "incident": "fortinet-fortios-and-fortiproxy-cve-2024-55591",
      "incidentTitle": "Fortinet FortiOS and FortiProxy: FortiOS and FortiProxy Authentication Bypass Vulnerability",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-01-14",
      "title": "CISA added CVE-2024-55591 to the KEV catalog (due 2025-01-21).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/fortinet-fortios-and-fortiproxy-cve-2024-55591"
    },
    {
      "incident": "fortinet-fortimanager-fortijump-cve-2024-47575",
      "incidentTitle": "FortiManager 'FortiJump' missing authentication zero-day (CVE-2024-47575)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-10-23",
      "title": "CVE-2024-47575 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-47575",
      "url": "https://pwn.watch/i/fortinet-fortimanager-fortijump-cve-2024-47575"
    },
    {
      "incident": "fortinet-fortimanager-fortijump-cve-2024-47575",
      "incidentTitle": "FortiManager 'FortiJump' missing authentication zero-day (CVE-2024-47575)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-10-23",
      "title": "CISA added CVE-2024-47575 to the KEV catalog (federal deadline 2024-11-13)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/fortinet-fortimanager-fortijump-cve-2024-47575"
    },
    {
      "incident": "fortinet-multiple-products-cve-2024-23113",
      "incidentTitle": "Fortinet Multiple Products Format String",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-10-09",
      "title": "CISA added CVE-2024-23113 to the KEV catalog (federal deadline 2024-10-30)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/fortinet-multiple-products-cve-2024-23113"
    },
    {
      "incident": "fortinet-forticlient-ems-cve-2023-48788",
      "incidentTitle": "Fortinet FortiClient EMS SQL Injection",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-03-25",
      "title": "CISA added CVE-2023-48788 to the KEV catalog (federal deadline 2024-04-15)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/fortinet-forticlient-ems-cve-2023-48788"
    },
    {
      "incident": "fortinet-forticlient-ems-cve-2023-48788",
      "incidentTitle": "Fortinet FortiClient EMS SQL Injection",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-03-12",
      "title": "CVE-2023-48788 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-48788",
      "url": "https://pwn.watch/i/fortinet-forticlient-ems-cve-2023-48788"
    },
    {
      "incident": "fortinet-multiple-products-cve-2024-23113",
      "incidentTitle": "Fortinet Multiple Products Format String",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-02-15",
      "title": "CVE-2024-23113 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-23113",
      "url": "https://pwn.watch/i/fortinet-multiple-products-cve-2024-23113"
    },
    {
      "incident": "fortinet-fortios-cve-2024-21762",
      "incidentTitle": "Fortinet FortiOS Out-of-Bound Write",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-02-09",
      "title": "CVE-2024-21762 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-21762",
      "url": "https://pwn.watch/i/fortinet-fortios-cve-2024-21762"
    },
    {
      "incident": "fortinet-fortios-cve-2024-21762",
      "incidentTitle": "Fortinet FortiOS Out-of-Bound Write",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-02-09",
      "title": "CISA added CVE-2024-21762 to the KEV catalog (federal deadline 2024-02-16)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/fortinet-fortios-cve-2024-21762"
    },
    {
      "incident": "fortinet-fortios-ssl-vpn-xortigate-cve-2023-27997",
      "incidentTitle": "FortiOS SSL-VPN pre-auth heap overflow (XORtigate, CVE-2023-27997)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-06-13",
      "title": "CISA adds CVE-2023-27997 to the KEV catalog",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/fortinet-fortios-ssl-vpn-xortigate-cve-2023-27997"
    },
    {
      "incident": "fortinet-fortios-ssl-vpn-xortigate-cve-2023-27997",
      "incidentTitle": "FortiOS SSL-VPN pre-auth heap overflow (XORtigate, CVE-2023-27997)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-06-12",
      "title": "Fortinet publishes FG-IR-23-097 and a blog post on exploitation and Volt Typhoon",
      "body": null,
      "sourceUrl": "https://www.fortinet.com/blog/psirt-blogs/analysis-of-cve-2023-27997-and-clarifications-on-volt-typhoon-campaign",
      "url": "https://pwn.watch/i/fortinet-fortios-ssl-vpn-xortigate-cve-2023-27997"
    },
    {
      "incident": "fortinet-fortios-cve-2022-41328",
      "incidentTitle": "Fortinet FortiOS: Path Traversal (CVE-2022-41328)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-03-14",
      "title": "CISA added CVE-2022-41328 to the KEV catalog (due 2023-04-04).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/fortinet-fortios-cve-2022-41328"
    }
  ]
}