Fortinet
- Exploited flaws
- 32in 10 products
- Added to CISA's list in 2026
- 98 in 2025
- Used by ransomware
- 14of 32, says CISA
- Disclosure to CISA's list
- 10 daysmedian; 14 of 26 listed within 30 days
Exploited flaws by the year they were disclosed
The year in each CVE ID, roughly when the flaw became public. Recent years can still grow: flaws are often exploited, and listed, years later.
Hover or tab through a year for its count.
Show as a table
| Year disclosed | Exploited flaws |
|---|---|
| 2018 | 4 |
| 2019 | 2 |
| 2020 | 1 |
| 2021 | 1 |
| 2022 | 3 |
| 2023 | 2 |
| 2024 | 4 |
| 2025 | 9 |
| 2026 | 6 |
Products exploited more than once
| Product | Flaws | First listed | Latest |
|---|---|---|---|
| FortiOS | 9 | 2021-11-03 | 2026-07-27 |
| Multiple Products | 7 | 2022-10-11 | 2026-10-16 |
| FortiOS and FortiProxy | 4 | 2022-01-10 | 2025-03-18 |
| FortiClient EMS | 3 | 2024-03-25 | 2026-04-13 |
| FortiWeb | 3 | 2025-07-18 | 2025-11-18 |
| FortiSandbox | 2 | 2026-07-16 | 2026-07-16 |
Latest on CISA's list
- Fortinet Multiple Products Path Traversal Vulnerability
- Fortinet FortiMail Path Traversal Vulnerability
- Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability
- Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
- Fortinet FortiSandbox OS Command Injection Vulnerability
- Fortinet FortiSandbox OS Command Injection Vulnerability
- Fortinet FortiClient EMS SQL Injection Vulnerability
- Fortinet FortiClient EMS Improper Access Control Vulnerability
- Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability
- Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability
In the news
No security story in the last 14 days named Fortinet in its headline.
From CISA's Known Exploited Vulnerabilities catalogue. "Disclosure to CISA's list" uses NVD's publication date and leaves out the 2021-11-03 launch, when CISA added hundreds of older flaws at once; CISA often lists a flaw after attacks have begun, so it's an upper limit on how fast exploitation came.