Fortinet Fortinet FortiOS

Name: Fortinet Fortinet FortiOS
Brand: Fortinet

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

1critical14high22medium2low

updated 2026-10-25

vulnerabilities (39)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2019-5591US	medium6.5OT critical	18.6% (97th)	KEV	no fix	2020-08-14	≤ FortiOS 6.2.0 and below.
CVE-2021-44168US	high7.8OT critical	0.86% (58th)	KEV	no fix	2022-01-04	≤ FortiOS before 7.0.3
CVE-2022-38380US	medium4.3	23.0% (98th)	—	no fix	2022-11-02	≤ FortiOS 7.2.0, 7.0.7, 7.0.6, 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0
CVE-2018-9185US	high8.1	2.12% (82nd)	—	no fix	2018-07-05	≤ FortiOS 6.0.0 and below
CVE-2021-26109US	critical9.8	1.88% (79th)	—	no fix	2021-12-08	≤ FortiOS before 7.0.1
CVE-2017-14182US	medium6.5	1.75% (78th)	—	no fix	2017-10-27	≤ FortiOS 5.4.5, 5.4.4, 5.4.3, 5.4.2, 5.4.1, 5.4.0
CVE-2021-41024US	high7.5	1.60% (76th)	—	no fix	2021-12-08	≤ FortiOS 7.0.1, 7.0.0 FortiProxy 7.0.0
CVE-2021-36173US	high8.8	1.55% (75th)	—	no fix	2021-12-08	≤ FortiOS 7.0.1, 7.0.0, 6.4.0 through 6.4.6, 6.2.0 through 6.2.9, 6.0.0 through 6.0.13
CVE-2021-44171US	high8.0	1.45% (73rd)	—	no fix	2022-10-10	≤ FortiOS 7.0.3, 7.0.2, 7.0.1, 7.0.0, 6.4.8, 6.4.7, 6.4.6, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.10, 6.2.9, 6.2.8, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.14, 6.0.13, 6.0.12, 6.0.11, 6.0.10, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0
CVE-2022-27491US	high7.5OT elevated	1.39% (72nd)	—	no fix	2022-09-06	≤ FortiOS 7.2.0, 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0, 6.4.9, 6.4.8, 6.4.7, 6.4.6, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.10, 6.2.9, 6.2.8, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.14, 6.0.13, 6.0.12, 6.0.11, 6.0.10, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0
CVE-2018-13384US	medium6.1	1.36% (72nd)	—	no fix	2019-06-04	≤ FortiOS all versions below 6.0.5
CVE-2017-7733US	medium6.1	1.28% (70th)	—	no fix	2017-10-27	≤ FortiOS 5.6.0, 5.4.5, 5.4.4, 5.4.3, 5.4.2, 5.4.1, 5.4.0
CVE-2021-26108US	high7.5OT elevated	1.12% (66th)	—	no fix	2021-12-08	≤ FortiOS before 7.0.1
CVE-2021-24018US	high8.8	1.03% (64th)	—	no fix	2021-08-04	≤ FortiOS before 7.0.1
CVE-2019-15703US	high7.5	1.00% (62nd)	—	no fix	2019-10-24	3 versions
CVE-2018-13365US	medium5.3	0.91% (60th)	—	no fix	2019-05-29	2 versions
CVE-2020-12818US	medium5.3	0.90% (59th)	—	no fix	2020-09-24	≤ FortiOS before 6.4.1
CVE-2018-13366US	medium5.3	0.87% (58th)	—	no fix	2019-04-09	2 versions
CVE-2019-5588US	medium6.1	0.83% (57th)	—	no fix	2019-06-04	≤ FortiOS 6.0.0 to 6.0.4
CVE-2019-5586US	medium6.1	0.83% (57th)	—	no fix	2019-06-04	≤ FortiOS 5.2.0 to 6.0.4
CVE-2020-15937US	medium6.1	0.83% (57th)	—	no fix	2021-03-03	≤ FortiOS 6.4.1, 6.2.5
CVE-2020-15938US	high7.5	0.77% (55th)	—	no fix	2021-03-04	≤ FortiOS 6.4.2, 6.2.5
CVE-2017-3128US	medium4.8	0.71% (53rd)	—	no fix	2017-05-23	≤ 5.0.0-5.0.14, 5.2.0-5.2.10
CVE-2022-23438US	medium6.1	0.71% (53rd)	—	no fix	2022-07-18	≤ FortiOS 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0, 6.4.9, 6.4.8, 6.4.7, 6.4.6, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0
CVE-2019-6696US	medium6.1	0.70% (53rd)	—	no fix	2020-03-15	3 versions
CVE-2022-35842US	high7.5	0.68% (52nd)	—	no fix	2022-11-02	≤ FortiOS 7.2.0, 7.0.6, 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0, 6.4.9, 6.4.8, 6.4.7, 6.4.6, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0
CVE-2020-15936US	medium4.5	0.65% (51st)	—	no fix	2022-03-01	≤ FortiOS 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.11, 6.0.10, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0, 5.6.13, 5.6.12, 5.6.11, 5.6.10, 5.6.9, 5.6.8, 5.6.7, 5.6.6, 5.6.5, 5.6.4, 5.6.3, 5.6.2, 5.6.1, 5.6.0
CVE-2021-41032US	medium5.4	0.60% (48th)	—	no fix	2022-05-04	≤ FortiOS 7.0.3, 7.0.2, 7.0.1, 7.0.0, 6.4.8, 6.4.7, 6.4.6, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.10, 6.2.9, 6.2.8, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0
CVE-2021-32600US	low3.8	0.59% (48th)	—	no fix	2021-11-17	≤ FortiOS 7.0.0, 6.4.0 through 6.4.6, 6.2.0 through 6.2.9, 6.0.x, 5.6.x
CVE-2022-23442US	medium4.3OT elevated	0.57% (47th)	—	no fix	2022-08-03	≤ FortiOS 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0, 6.4.8, 6.4.7, 6.4.6, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.11, 6.2.10, 6.2.9, 6.2.8, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0
CVE-2021-41019US	medium6.5	0.57% (46th)	—	no fix	2021-11-02	≤ FortiOS 6.4.6, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.9, 6.2.8, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1
CVE-2022-30307US	high8.1	0.48% (41st)	—	no fix	2022-11-02	≤ FortiOS 7.2.0 and below, 7.0.6 and below, 6.4.9 and below
CVE-2021-24012US	high7.3	0.48% (40th)	—	no fix	2021-06-02	≤ FortiOS 6.4.0 to 6.4.4
CVE-2019-5587US	medium6.5OT elevated	0.47% (40th)	—	no fix	2019-06-04	≤ FortiOS all versions below 6.0.5
CVE-2021-26103US	high8.8OT elevated	0.44% (37th)	—	no fix	2021-12-08	≤ FortiOS 7.0.0, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.9, 6.2.8, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.14, 6.0.13, 6.0.12, 6.0.11, 6.0.10, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0, 5.6.14, 5.6.13, 5.6.12, 5.6.11, 5.6.10, 5.6.9, 5.6.8, 5.6.7, 5.6.6, 5.6.5, 5.6.4, 5.6.3, 5.6.2, 5.6.1, 5.6.0
CVE-2021-43080US	medium5.4	0.43% (36th)	—	no fix	2022-09-06	≤ FortiOS 7.2.0, 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0, 6.4.9, 6.4.8, 6.4.7, 6.4.6, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0
CVE-2022-29053US	low3.3	0.27% (18th)	—	no fix	2022-09-06	≤ FortiOS 7.2.0, 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0, 6.4.9, 6.4.8, 6.4.7, 6.4.6, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.10, 6.2.9, 6.2.8, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.14, 6.0.13, 6.0.12, 6.0.11, 6.0.10, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0
CVE-2021-36169US	medium6.0OT elevated	0.26% (17th)	—	no fix	2021-12-13	≤ FortiOS 7.0.0, 6.4.6, 6.2.9
CVE-2022-22306US	medium5.3	0.20% (10th)	—	no fix	2022-05-24	≤ FortiOS 6.0.0 through 6.0.14, 6.2.0 through 6.2.10, 6.4.0 through 6.4.8, 7.0.0

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')7 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor6 CVEs
CWE-345Insufficient Verification of Data Authenticity4 CVEs
CWE-20Improper Input Validation3 CVEs
CWE-295Improper Certificate Validation3 CVEs
CWE-284Improper Access Control2 CVEs
CWE-601URL Redirection to Untrusted Site ('Open Redirect')2 CVEs
CWE-787Out-of-bounds Write2 CVEs

sources (1)

Which sources assert this record, and when.

EUEU Vulnerability Database (ENISA)39 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan