Fortinet product

FortiOS

← All Fortinet products

No CISA KEV deadline is open. CISA last added a FortiOS CVE on 27 Jul.

Tracked since 10 Feb · latest article Fri 23 Oct · RSS

Open KEV deadlines: 0; None open
Added to KEV · 90 days: 0; of 9 in the full CISA catalogue · all time
High exploit odds · current: 0; EPSS top 5%, not in KEV
Articles · 7 days: 2; usual rate

Exploited, by due date

CSV download

CVEProductAddedDue · federal deadline

Deadlines passed

CVE-2025-68686FortiOS27 JulDeadline passed 10 Aug5 articles

CVE-2019-6693FortiOS25 Jun 2025Deadline passed 16 Jul 2025Known ransomware use · 1 article

CVE-2024-21762FortiOS9 Feb 2024Deadline passed 16 Feb 2024Known ransomware use · 1 article

CVE-2022-41328FortiOS14 Mar 2023Deadline passed 4 Apr 20231 article

CVE-2022-42475FortiOS13 Dec 2022Deadline passed 3 Jan 2023Known ransomware use · 1 article

CVE-2021-44168not in CyberSIXT coverageFortiOS10 Dec 2021Deadline passed 24 Dec 2021

CVE-2018-13379FortiOS3 Nov 2021Deadline passed 3 May 2022Known ransomware use · 1 article

CVE-2019-5591not in CyberSIXT coverageFortiOS3 Nov 2021Deadline passed 3 May 2022Known ransomware use

CVE-2020-12812not in CyberSIXT coverageFortiOS3 Nov 2021Deadline passed 3 May 2022Known ransomware use

Coverage

23 articles · all timeFull timeline

23 articles from 9 outlets since 10 Feb; 2 in the last 7 days.

Article
First report
Official notice

Show as table

FortiOS: articles
Published (UTC)	Outlet	Headline
Fri 23 Oct · 02:08 UTC	SecurityOnline	Hackers Steal 70,000 Credentials in Fortinet and Palo Alto Attacks
Tue 20 Oct · 12:30 UTC	SOCRadar	Japan’s October Breach Wave Exposes Millions of Customer Records
Mon 19 Oct · 11:36 UTC	SecurityWeek	Fortinet Flaw Exploits Led to Stealthy FortiGate Implant in Telecom Breach
Sat 17 Oct · 12:00 UTC	Security Affairs	CISA Flags Fortinet and BeyondTrust Flaws Under Active Attack
Fri 16 Oct · 19:02 UTC	CISA	CISA Flags Fortinet Path Traversal Flaw Under Active Exploitation
Fri 16 Oct · 09:45 UTC	Security Affairs	Hackers Stole Fortinet Credentials from 500 Firewalls via FortiManager
Fri 16 Oct · 06:42 UTC	The Hacker News	Fortinet flaw lets stealthy PEERSTITCH malware hijack firewall processes
Thu 15 Oct · 04:01 UTC	SecurityOnline	Hackers Used FortiManager Flaws to Compromise 500 Firewalls
Wed 14 Oct · 22:18 UTC	Unit 42	Hackers Stole Configurations for 500 FortiGate Firewalls in FortiManager Breach
Tue 15 Sep · 13:49 UTC	SecurityWeek	Attackers Exploited Fortinet and F5 Flaws to Target Thai ISP 3BB
Wed 9 Sep · 14:48 UTC	SecurityWeek	Fortinet Patches Critical Flaws Enabling JWT Bypass and Traffic Hijacking
Fri 4 Sep · 13:22 UTC	SecurityOnline	Gentlemen Ransomware Storms Networks Through Fortinet VPNs
Tue 11 Aug · 22:01 UTC	Dark Reading	Gunra Ransomware Gang Exploits Fortinet Flaws, Bypasses MFA
Tue 28 Jul · 09:01 UTC	Security Affairs	U.S. CISA adds Arista VeloCloud Orchestrator and Fortinet FortiOS flaws to its Known Exploited Vulnerabilities catalog
Tue 28 Jul · 08:46 UTC	CISA	Fortinet FortiOS bug CVE-2025-68686 exposes data to hackers
Mon 27 Jul · 22:51 UTC	CISA	CISA adds FortiOS info leak CVE-2025-68686 to KEV, urges patch
Mon 27 Jul · 22:32 UTC	SecurityOnline	CISA adds Arista VeloCloud RCE and Fortinet FortiOS bypass to KEV
Wed 13 May · 13:31 UTC	Check Point	Gentlemen RaaS leak reveals 332 victims, internal chats exposed
Wed 13 May · 09:49 UTC	SecurityWeek	Fortinet and Ivanti patch 18 flaws, including three critical bugs
Thu 19 Mar · 15:04 UTC	The Hacker News	ThreatsDay Bulletin: FortiGate RaaS, Citrix Exploits, MCP Abuse, LiveChat Phish & More
Thu 12 Mar · 16:11 UTC	CISA	Siemens RUGGEDCOM APE1808 Devices
Wed 11 Feb · 10:05 UTC	SecurityWeek	Fortinet Patches High-Severity Vulnerabilities
Tue 10 Feb · 09:25 UTC	Security Affairs	China-linked APT UNC3886 targets Singapore telcos

Who reported 9 outlets, last 12 months

SecurityWeek5
Security Affairs4
CISA4
SecurityOnline4
The Hacker News2
Check Point1
Others3

23 OctHackers Steal 70,000 Credentials in Fortinet and Palo Alto AttacksSecurityOnline
20 OctJapan’s October Breach Wave Exposes Millions of Customer RecordsSOCRadar
19 OctFortinet Flaw Exploits Led to Stealthy FortiGate Implant in Telecom BreachSecurityWeek
17 OctCISA Flags Fortinet and BeyondTrust Flaws Under Active AttackSecurity Affairs
16 OctCISA Flags Fortinet Path Traversal Flaw Under Active ExploitationCISA · official notice
16 OctHackers Stole Fortinet Credentials from 500 Firewalls via FortiManagerSecurity Affairs
16 OctFortinet flaw lets stealthy PEERSTITCH malware hijack firewall processesThe Hacker News
15 OctHackers Used FortiManager Flaws to Compromise 500 FirewallsSecurityOnline
14 OctHackers Stole Configurations for 500 FortiGate Firewalls in FortiManager BreachUnit 42
15 SepAttackers Exploited Fortinet and F5 Flaws to Target Thai ISP 3BBSecurityWeek

All CVEs in coverage

CVE-2018-13379Fortinet FortiOS SSL VPN Path Traversal VulnerabilityCVSS9.1CriticalExploited99.9%EPSS1article

CVE-2022-42475Fortinet FortiOS Heap-Based Buffer Overflow VulnerabilityCVSS9.3CriticalExploited99.4%EPSS1article

CVE-2024-55591Fortinet FortiOS and FortiProxy Authentication Bypass VulnerabilityCVSS9.6CriticalExploited94%EPSS5articles

CVE-2023-27997Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow VulnerabilityCVSS9.2CriticalExploited86%EPSS1article

CVE-2024-21762Fortinet FortiOS Out-of-Bound Write VulnerabilityCVSS9.6CriticalExploited85%EPSS1article

CVE-2025-68686Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor VulnerabilityCVSS5.3MediumExploited30%EPSS5articles

CVE-2022-41328Fortinet FortiOS Path Traversal VulnerabilityCVSS6.5MediumExploited11%EPSS1article

CVE-2025-24472Fortinet FortiOS and FortiProxy Authentication Bypass VulnerabilityCVSS8.1HighExploited7.2%EPSS1article

CVE-2019-6693Fortinet FortiOS Use of Hard-Coded Credentials VulnerabilityCVSS6.5MediumExploited6.6%EPSS1article

CVE-2025-61624Fortinet Multiple Products Path Traversal VulnerabilityCVSS5.4MediumExploited1.3%EPSS7articles

CVE-2025-64157Fortinet FortiOS vulnerabilityCVSSUnrated–Not in KEV1.5%EPSS1article

CVE-2026-22153Fortinet FortiOS vulnerabilityCVSSUnrated–Not in KEV0.8%EPSS1article

4 more CVEs

CVE-2025-53844Fortinet FortiOS vulnerabilityCVSS8.3High–Not in KEV0.6%EPSS1article

CVE-2025-55018Fortinet FortiOS vulnerabilityCVSSUnrated–Not in KEV0.4%EPSS1article

CVE-2026-84393Fortinet FortiOS vulnerabilityCVSS7.3High–Not in KEV0.3%EPSS1article

CVE-2025-62439Fortinet FortiOS vulnerabilityCVSSUnrated–Not in KEV0.2%EPSS1article

How these numbers are made

CISA KEV counts use the full catalogue, refreshed every 10 minutes. CVEs in coverage are those recorded by CyberSIXT. BOD 22-01 deadlines bind US federal civilian agencies.

CVEs with FIRST EPSS at or above the 95th percentile (top 5%), excluding CVEs in CISA KEV. EPSS estimates exploitation probability over the next 30 days.

Coverage is above its usual rate at three or more articles in 7 days and at least 2.5 times the weekly mean of the preceding 8 weeks.

Product names are grouped by normalised names, with version and edition tails removed.

Fix listed refers to an advisory. Unknown fix status is counted as not listed.

FortiOS

Exploited, by due date

Coverage

All CVEs in coverage

On this device

Intel

Settings

Keyboard shortcuts