Fortinet CVEs, last 30 days (26 CVEs)
CVE Title CVSS Type Status CVE-2026-126170 An Improper Encoding or Escaping of Output vulnerability [CWE-116] in FortiSASE-Sovereign, FortiAnalyzer, FortiManager, FortiAnalyzer Cloud, FortiManager Cloud ... 9.8 Unknown/Unlisted Weakness Not exploited CVE-2026-107656 An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiS... 9.8 Unknown/Unlisted Weakness Not exploited CVE-2026-106173 A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unautho... 9.8 Path Traversal Not exploited CVE-2026-121529 A origin validation error vulnerability in Fortinet FortiClientMac 7.4.0 through 7.4.7, FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2.0 through... 9.6 Unknown/Unlisted Weakness Not exploited CVE-2026-126253 An Authentication Bypass by Primary Weakness vulnerability [cwe-305] in FortiOS and FortiSASE ospf daemon may allow an unauthenticated attacker to broadcast LSA... 9.3 Unknown/Unlisted Weakness Not exploited CVE-2026-126262 Improper neutralization of special elements used in an SQL command in FortiManager 9.3 SQL Injection Not exploited CVE-2026-126229 Authorization Bypass in FortiManager, FortiAnalyzer, FortiManager Cloud and FortiAnalyzer Cloud 9.1 Unknown/Unlisted Weakness Not exploited CVE-2026-126261 Improper authorizatin vulnerability in FortiManager 9.0 Unknown/Unlisted Weakness Not exploited CVE-2026-126260 Server side request forgery vulnerability in FortiAnalyzer, FortiManager with FortiAnalyzer features & FortiAnalyzer-BigData 9.0 Unknown/Unlisted Weakness Not exploited CVE-2026-126259 Missing authentication for critical function in FortiOS 9.0 Unknown/Unlisted Weakness Not exploited CVE-2026-26248 A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox ... 8.8 Cross-site Scripting (XSS) Not exploited CVE-2025-57739 An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 through... 8.8 SQL Injection Not exploited CVE-2025-46773 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 thr... 8.8 SQL Injection Not exploited CVE-2026-126184 An authentication bypass by spoofing vulnerability (CWE-290) in FortiAnalyzer, FortiAnalyzer Cloud, FortiAnalyzer-BigData, FortiManager, FortiManager Cloud, For... 8.2 Unknown/Unlisted Weakness Not exploited CVE-2025-61625 An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4... 8.1 Path Traversal Not exploited CVE-2026-106174 A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network access to the device ... 7.5 Unknown/Unlisted Weakness Not exploited CVE-2026-126178 A Heap-based Buffer Overflow vulnerability [CWE-122] in FortiManager, FortiAnalyzer, FortiManager Cloud and FortiAnalyzer Cloud may allow an authenticated attac... 7.2 Unknown/Unlisted Weakness Not exploited CVE-2026-23705 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 thr... 7.2 SQL Injection Not exploited CVE-2026-23707 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 thr... 7.2 SQL Injection Not exploited CVE-2026-121530 A improper authentication vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6 may allow a remote authenticated attacker to gain improper access control via an... 6.6 Improper Authentication Not exploited CVE-2026-23706 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 thr... 6.5 SQL Injection Not exploited CVE-2026-106171 A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 th... 6.1 OS Command Injection Not exploited CVE-2026-106172 A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all version... 5.3 Unknown/Unlisted Weakness Not exploited CVE-2026-106170 An Uncaught Exception vulnerability [CWE-248] vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all... 4.9 Unknown/Unlisted Weakness Not exploited CVE-2026-106176 A missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via Specially crafted HTTP request... 3.8 Missing Authorization Not exploited CVE-2026-106175 A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.8, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all... 2.3 Unknown/Unlisted Weakness Not exploited