Fortinet vulnerabilities exploited in the wild

The Fortinet CVEs that CISA lists as exploited, newest first. Only confirmed exploitation appears here, each with its EPSS and the CVSS as published.

Build snapshot collected 3 Oct 2026, 08:57 UTC · KEV catalog 2026.10.02 · EPSS of 2 Oct 2026 · not a live feed: collected once, at build time

31
flaws with confirmed attacks: 14
used by ransomware: 1.8%
of the whole catalog

Most recent addition: CVE-2026-104286, on 1 Oct 2026.

12 vulnerabilities · newest first.Showing the entries bundled with this page while the full catalog loads.

RSS of KEV additions

CVE-2026-104286Exploited · KEV: listed in the CISA Known Exploited Vulnerabilities catalog
Fortinet · FortiMail
Fortinet FortiMail Path Traversal Vulnerability
Severity
9.8CRITICALCVSS 3.1 · fortinet.com
Attack probability (EPSS)
1.78%77th pct
KEV dates
added 1 Oct 2026due 4 Oct 2026
CVE-2025-25249Exploited · KEV: listed in the CISA Known Exploited Vulnerabilities catalog
Fortinet · Multiple Products
Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability
Severity
9.8CRITICALCVSS 3.1 · NVD
Attack probability (EPSS)
3.86%90th pct
KEV dates
added 9 Sep 2026due 12 Sep 2026
CVE-2025-68686Exploited · KEV: listed in the CISA Known Exploited Vulnerabilities catalog
Fortinet · FortiOS
Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
Severity
5.9MEDIUMCVSS 3.1 · fortinet.com
Attack probability (EPSS)
29.6%98th pct
KEV dates
added 27 Jul 2026due 10 Aug 2026
CVE-2026-25089Exploited · KEV: listed in the CISA Known Exploited Vulnerabilities catalog
Fortinet · FortiSandbox
Fortinet FortiSandbox OS Command Injection Vulnerability
Severity
9.8CRITICALCVSS 3.1 · fortinet.com
Attack probability (EPSS)
76.1%99.5th pct
KEV dates
added 16 Jul 2026due 19 Jul 2026
CVE-2026-39808Exploited · KEV: listed in the CISA Known Exploited Vulnerabilities catalog
Fortinet · FortiSandbox
Fortinet FortiSandbox OS Command Injection Vulnerability
Severity
9.8CRITICALCVSS 3.1 · fortinet.com
Attack probability (EPSS)
47.4%99th pct
KEV dates
added 16 Jul 2026due 19 Jul 2026
CVE-2026-21643Exploited · KEV: listed in the CISA Known Exploited Vulnerabilities catalog
Fortinet · FortiClient EMS
Fortinet FortiClient EMS SQL Injection Vulnerability
Severity
9.8CRITICALCVSS 3.1 · fortinet.com
Attack probability (EPSS)
93.7%99.8th pct
KEV dates
added 13 Apr 2026due 16 Apr 2026
CVE-2026-35616Exploited · KEV: listed in the CISA Known Exploited Vulnerabilities catalog
Fortinet · FortiClient EMS
Fortinet FortiClient EMS Improper Access Control Vulnerability
Severity
9.8CRITICALCVSS 3.1 · fortinet.com
Attack probability (EPSS)
9.10%95th pct
KEV dates
added 6 Apr 2026due 9 Apr 2026
CVE-2026-24858Exploited · KEV: listed in the CISA Known Exploited Vulnerabilities catalog
Fortinet · Multiple Products
Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability
Severity
9.8CRITICALCVSS 3.1 · fortinet.com
Attack probability (EPSS)
85.8%99.7th pct
KEV dates
added 27 Jan 2026due 30 Jan 2026
CVE-2025-59718Exploited · KEV: listed in the CISA Known Exploited Vulnerabilities catalog
Fortinet · Multiple Products
Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability
Severity
9.8CRITICALCVSS 3.1 · fortinet.com
Attack probability (EPSS)
68.3%99.3th pct
KEV dates
added 16 Dec 2025due 23 Dec 2025
CVE-2025-58034Exploited · KEV: listed in the CISA Known Exploited Vulnerabilities catalog
Fortinet · FortiWeb
Fortinet FortiWeb OS Command Injection Vulnerability
Severity
7.2HIGHCVSS 3.1 · fortinet.com
Attack probability (EPSS)
55.6%99.0th pct
KEV dates
added 18 Nov 2025due 25 Nov 2025
CVE-2025-64446Exploited · KEV: listed in the CISA Known Exploited Vulnerabilities catalog
Fortinet · FortiWeb
Fortinet FortiWeb Path Traversal Vulnerability
Severity
9.8CRITICALCVSS 3.1 · fortinet.com
Attack probability (EPSS)
91.8%99.8th pct
KEV dates
added 14 Nov 2025due 21 Nov 2025
CVE-2025-25257Exploited · KEV: listed in the CISA Known Exploited Vulnerabilities catalog
Fortinet · FortiWeb
Fortinet FortiWeb SQL Injection Vulnerability
Severity
9.8CRITICALCVSS 3.1 · NVD
Attack probability (EPSS)
99.8%100th pct
KEV dates
added 18 Jul 2025due 8 Aug 2025

Fortinet products in the catalog

Among the most recent entries, the products that appear most often are:

Multiple Products3 entries
FortiWeb3 entries
FortiSandbox2 entries
FortiClient EMS2 entries
FortiMail1 entry
FortiOS1 entry

Product names are the ones CISA uses in the catalog. To check a specific Fortinet CVE that is not on this page, use the CVE lookup: it shows the record, the affected versions and the EPSS score even when the CVE is not in KEV.

Fixed versions and workarounds are published by the vendor: FortiGuard PSIRT advisories.

Other vendors

Questions

How many Fortinet vulnerabilities are known to be exploited?

The CISA KEV catalog, version 2026.10.02, lists 31 Fortinet vulnerabilities as of 3 Oct 2026. CISA marks 14 of them as known to be used in ransomware campaigns.

What is the most recent Fortinet entry in KEV?

CVE-2026-104286 (Fortinet FortiMail Path Traversal Vulnerability), added on 1 Oct 2026 with a due date of 4 Oct 2026 for US federal agencies, as of the collection of 3 Oct 2026.

Does this page list every Fortinet CVE?

No. It lists only the Fortinet CVEs that CISA has confirmed as exploited. Fortinet publishes many more CVEs that are not in KEV; look up any of them by identifier in the CVE lookup to see its record and EPSS score.

In what order should Fortinet vulnerabilities be patched?

Everything on this page is already confirmed as exploited, so all of it is urgent where the product is in use. Within the list, entries marked with known ransomware use and those with the highest EPSS come first in the "Risk" order; internet-facing systems should go before internal ones.