Fortinet
CPE vendor key: fortinet ·
1,302 CVEs published in the last 24 months.
CVEs (365 d)
504
▲ +3 vs prior 30d
Avg CVSS (365 d)
6.48
over 504 CVEs
Avg EPSS pct (365 d)
0.36
higher = more likely exploited
KEV hit rate (365 d)
2.2%
11 of 504 added to CISA KEV
LLM-credited CVEs
0
none detected
Monthly CVE volume — last 24 months
Each point is one calendar month. Bars in the
severity card to the right slice the same volume by CVSS band.
Severity mix
Stacked by CVSS band (Critical / High / Medium /
Low) using the best available metric per CVE.
Top affected products (24 mo)
95
54
51
43
43
28
26
26
19
18
Distinct CVEs that include each product in their
CPE configuration.
Top CWEs (24 mo)
39
27
25
24
16
16
15
12
10
9
Distinct CVEs assigned each weakness.
Recent CISA KEV adds (last 12 months)
| Added | CVE | Product | KEV name |
|---|---|---|---|
| 2026-10-01 | CVE-2026-104286 | FortiMail | Fortinet FortiMail Path Traversal Vulnerability |
| 2026-09-09 | CVE-2025-25249 | Multiple Products | Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability |
| 2026-07-27 | CVE-2025-68686 | FortiOS | Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability |
| 2026-07-16 | CVE-2026-39808 | FortiSandbox | Fortinet FortiSandbox OS Command Injection Vulnerability |
| 2026-07-16 | CVE-2026-25089 | FortiSandbox | Fortinet FortiSandbox OS Command Injection Vulnerability |
| 2026-04-13 | CVE-2026-21643 | FortiClient EMS | Fortinet FortiClient EMS SQL Injection Vulnerability |
| 2026-04-06 | CVE-2026-35616 | FortiClient EMS | Fortinet FortiClient EMS Improper Access Control Vulnerability |
| 2026-01-27 | CVE-2026-24858 | Multiple Products | Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability |
| 2025-12-16 | CVE-2025-59718 | Multiple Products | Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability |
| 2025-11-18 | CVE-2025-58034 | FortiWeb | Fortinet FortiWeb OS Command Injection Vulnerability |
| 2025-11-14 | CVE-2025-64446 | FortiWeb | Fortinet FortiWeb Path Traversal Vulnerability |
Filtered to KEV entries whose CISA vendor or product name matches this
vendor exactly, to drop cross-OS noise (e.g. third-party Windows apps
that CPE-map to Microsoft).
Known exploited, all time (31)
| Published | CVE |
|---|---|
| 2026-10-01 | CVE-2026-104286 |
| 2026-06-09 | CVE-2026-25089 |
| 2026-04-14 | CVE-2026-39808 |
| 2026-04-04 | CVE-2026-35616 |
| 2026-02-10 | CVE-2025-68686 |
| 2026-02-06 | CVE-2026-21643 |
| 2026-01-27 | CVE-2026-24858 |
| 2026-01-13 | CVE-2025-25249 |
| 2025-12-09 | CVE-2025-59718 |
| 2025-11-18 | CVE-2025-58034 |
| 2025-11-14 | CVE-2025-64446 |
| 2025-07-17 | CVE-2025-25257 |
| 2025-05-13 | CVE-2025-32756 |
| 2025-02-11 | CVE-2025-24472 |
| 2025-01-14 | CVE-2024-55591 |
| 2024-10-23 | CVE-2024-47575 |
| 2024-03-12 | CVE-2023-48788 |
| 2024-02-15 | CVE-2024-23113 |
| 2024-02-09 | CVE-2024-21762 |
| 2023-06-13 | CVE-2023-27997 |
| 2023-03-07 | CVE-2022-41328 |
| 2023-01-02 | CVE-2022-42475 |
| 2022-10-18 | CVE-2022-40684 |
| 2022-01-04 | CVE-2021-44168 |
| 2020-08-14 | CVE-2019-5591 |
| 2020-07-24 | CVE-2020-12812 |
| 2019-11-21 | CVE-2019-6693 |
| 2019-06-04 | CVE-2018-13379 |
| 2019-06-04 | CVE-2018-13382 |
| 2019-05-29 | CVE-2018-13383 |
| 2019-01-22 | CVE-2018-13374 |
Attributed by CPE rather than by CISA's vendor name, so it includes
CVEs filed under another vendor whose affected-product list names this
one — shared library code is the usual reason. Broader, and
noisier, than the name-matched card above on purpose.
Generated 16 October 2026 14:24 UTC .