Advisories · Technology

Fortinet FortiWeb.

Every CVE that names Fortinet FortiWeb among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-26035 CVE record

CVSS 8.8 High

Improper authentication in Fortinet FortiWeb
- Fortinet FortiWeb
- Authentication bypass
Not analysed yet 12 Aug 2026
CVE-2026-70466 CVE record

CVSS 4.8 Medium

Fortinet FortiWeb: A incomplete list of disallowed inputs vulnerability in Fortinet FortiWeb 8.0.0 through…
- Fortinet FortiWeb
- Fortinet FortiOS
- CWE-184
Not analysed yet 12 Aug 2026
CVE-2026-40688 CVE record

CVSS 6.7 Medium

Out-of-bounds write in Fortinet FortiWeb
- Fortinet FortiWeb
- Memory corruption
Not analysed yet 14 Apr 2026
CVE-2026-39811 CVE record

CVSS 4.4 Medium

Integer overflow in Fortinet FortiWeb
- Fortinet FortiWeb
- Memory corruption
Not analysed yet 14 Apr 2026
CVE-2026-39814 CVE record

CVSS 6.2 Medium

Path traversal in Fortinet FortiWeb
- Fortinet FortiWeb
- Path traversal
Not analysed yet 14 Apr 2026
CVE-2025-66178 CVE record

CVSS 6.7 Medium

OS command injection in Fortinet FortiWeb
- Fortinet FortiWeb
- Command injection
Not analysed yet 10 Mar 2026
CVE-2026-24641 CVE record

CVSS 2.5 Low

NULL pointer dereference in Fortinet FortiWeb
- Fortinet FortiWeb
- Memory corruption
Not analysed yet 10 Mar 2026
CVE-2026-24640 CVE record

CVSS 5.9 Medium

Stack-based buffer overflow in Fortinet FortiWeb
- Fortinet FortiWeb
- Memory corruption
Not analysed yet 10 Mar 2026
CVE-2026-24017 CVE record

CVSS 7.3 High

Fortinet FortiWeb: An Improper Control of Interaction Frequency vulnerability [CWE-799] vulnerability in…
- Fortinet FortiWeb
- CWE-799
Not analysed yet 10 Mar 2026
CVE-2025-48840 CVE record

CVSS 5.0 Medium

Authentication bypass by spoofing in Fortinet FortiWeb
- Fortinet FortiWeb
- Authentication bypass
Not analysed yet 10 Mar 2026
CVE-2026-30897 CVE record

CVSS 5.9 Medium

Stack-based buffer overflow in Fortinet FortiWeb
- Fortinet FortiWeb
- Memory corruption
Not analysed yet 10 Mar 2026
CVE-2026-24858 CVE record

CVSS 9.4 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

Authentication bypass in Fortinet FortiWeb and others
- Fortinet FortiWeb
- Fortinet FortiNAC-F
- Authentication bypass
Not analysed yet 27 Jan 2026
CVE-2025-59719 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Improper signature verification in Fortinet FortiWeb
- Fortinet FortiWeb
- Weak cryptography or TLS
Not analysed yet 9 Dec 2025
CVE-2025-64471 CVE record

CVSS 4.4 Medium

Fortinet FortiWeb: A use of password hash instead of password for authentication vulnerability [CWE-836]…
- Fortinet FortiWeb
- CWE-836
Not analysed yet 9 Dec 2025
CVE-2025-64447 CVE record

CVSS 7.1 High

Fortinet FortiWeb: A reliance on cookies without validation and integrity checking vulnerability in Fortinet…
- Fortinet FortiWeb
- CWE-565
Not analysed yet 9 Dec 2025
CVE-2025-59669 CVE record

CVSS 4.8 Medium

Hard-coded credentials in Fortinet FortiWeb
- Fortinet FortiWeb
- Hard-coded credentials
Not analysed yet 18 Nov 2025
CVE-2025-58034 CVE record

CVSS 6.7 MediumCritical · KEVKEV

OS command injection in Fortinet FortiWeb
- Fortinet FortiWeb
- Command injection
Not analysed yet 18 Nov 2025
CVE-2025-64446 CVE record

CVSS 9.4 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

Path traversal in Fortinet FortiWeb
- Fortinet FortiWeb
- Path traversal
Not analysed yet 14 Nov 2025
CVE-2024-47569 CVE record

CVSS 4.2 Medium

Information disclosure in Fortinet FortiManager and others
- Fortinet FortiManager
- Fortinet FortiOS
- Information disclosure
Not analysed yet 14 Oct 2025
CVE-2025-53609 CVE record

CVSS 4.7 Medium

Path traversal in Fortinet FortiWeb
- Fortinet FortiWeb
- Path traversal
Not analysed yet 9 Sept 2025
CVE-2025-47857 CVE record

CVSS 6.5 Medium

OS command injection in Fortinet FortiWeb
- Fortinet FortiWeb
- Command injection
Not analysed yet 12 Aug 2025
CVE-2025-27759 CVE record

CVSS 6.7 Medium

OS command injection in Fortinet FortiWeb
- Fortinet FortiWeb
- Command injection
Not analysed yet 12 Aug 2025
CVE-2025-52970 CVE record

CVSS 7.7 HighCritical · CVSS 7+ and EPSS

Fortinet FortiWeb: A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below…
- Fortinet FortiWeb
- CWE-233
Not analysed yet 12 Aug 2025
CVE-2025-32766 CVE record

CVSS 6.3 Medium

Stack-based buffer overflow in Fortinet FortiWeb
- Fortinet FortiWeb
- Memory corruption
Not analysed yet 12 Aug 2025
CVE-2025-25257 CVE record

CVSS 9.6 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

SQL injection in Fortinet FortiWeb
- Fortinet FortiWeb
- SQL injection
Not analysed yet 17 Jul 2025
CVE-2025-22254 CVE record

CVSS 6.5 Medium

Improper privilege management in Fortinet FortiOS and others
- Fortinet FortiOS
- Fortinet FortiProxy
- Privilege escalation
Not analysed yet 10 Jun 2025
CVE-2024-50565 CVE record

CVSS 3.0 Low

Fortinet FortiOS: A improper restriction of communication channel to intended endpoints vulnerability…
- Fortinet FortiOS
- Fortinet FortiVoice
- CWE-300
Not analysed yet 8 Apr 2025
CVE-2024-46671 CVE record

CVSS 5.6 Medium

Fortinet FortiWeb: An Incorrect User Management vulnerability [CWE-286] in FortiWeb version 7.6.2 and below…
- Fortinet FortiWeb
- CWE-286
Not analysed yet 8 Apr 2025
CVE-2025-25254 CVE record

CVSS 6.8 Medium

Path traversal in Fortinet FortiWeb
- Fortinet FortiWeb
- Path traversal
Not analysed yet 8 Apr 2025
CVE-2023-25610 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.6, version 6.4.0 through 6.4.11 and v…
- Fortinet FortiSwitchManager
- Fortinet FortiAnalyzer
- Memory corruption
Not analysed yet 24 Mar 2025
CVE-2024-55594 CVE record

CVSS 5.5 Medium

Fortinet FortiWeb: An improper handling of syntactically invalid structure in Fortinet FortiWeb at least…
- Fortinet FortiWeb
- CWE-228
Not analysed yet 14 Mar 2025
CVE-2022-29059 CVE record

CVSS 2.6 Low

SQL injection in Fortinet FortiWeb
- Fortinet FortiWeb
- SQL injection
Not analysed yet 14 Mar 2025
CVE-2024-45324 CVE record

CVSS 7.0 High

Uncontrolled format string in Fortinet FortiPAM and others
- Fortinet FortiPAM
- Fortinet FortiWeb
- Memory corruption
Not analysed yet 11 Mar 2025
CVE-2023-42784 CVE record

CVSS 5.5 Medium

Fortinet FortiWeb: An improper handling of syntactically invalid structure in Fortinet FortiWeb at least…
- Fortinet FortiWeb
- CWE-228
Not analysed yet 11 Mar 2025
CVE-2024-55597 CVE record

CVSS 5.2 Medium

Path traversal in Fortinet FortiWeb
- Fortinet FortiWeb
- Path traversal
Not analysed yet 11 Mar 2025
CVE-2024-50567 CVE record

CVSS 6.8 Medium

OS command injection in Fortinet FortiWeb
- Fortinet FortiWeb
- Command injection
Not analysed yet 11 Feb 2025
CVE-2024-50569 CVE record

CVSS 6.3 Medium

OS command injection in Fortinet FortiWeb
- Fortinet FortiWeb
- Command injection
Not analysed yet 11 Feb 2025
CVE-2024-48885 CVE record

CVSS 5.2 Medium

Path traversal in Fortinet FortiVoice and others
- Fortinet FortiVoice
- Fortinet FortiRecorder
- Path traversal
Not analysed yet 16 Jan 2025
CVE-2024-21758 CVE record

CVSS 6.1 Medium

Stack-based buffer overflow in Fortinet FortiWeb
- Fortinet FortiWeb
- Memory corruption
Not analysed yet 14 Jan 2025
CVE-2024-55593 CVE record

CVSS 2.6 Low

SQL injection in Fortinet FortiWeb
- Fortinet FortiWeb
- SQL injection
Not analysed yet 14 Jan 2025
CVE-2024-36509 CVE record

CVSS 3.8 Low

Fortinet FortiWeb: An exposure of sensitive system information to an unauthorized control sphere…
- Fortinet FortiWeb
- Information disclosure
Not analysed yet 12 Nov 2024
CVE-2024-33509 CVE record

CVSS 4.4 Medium

Improper certificate validation in Fortinet FortiWeb
- Fortinet FortiWeb
- Weak cryptography or TLS
Not analysed yet 9 Jul 2024
CVE-2024-23665 CVE record

CVSS 5.6 Medium

Improper authorization in Fortinet FortiWeb
- Fortinet FortiWeb
- Broken access control
Not analysed yet 3 Jun 2024
CVE-2024-23107 CVE record

CVSS 5.2 Medium

Information disclosure in Fortinet FortiWeb
- Fortinet FortiWeb
- Information disclosure
Not analysed yet 3 Jun 2024
CVE-2023-46713 CVE record

CVSS 4.9 Medium

Log injection in Fortinet FortiWeb
- Fortinet FortiWeb
- Other injection
Not analysed yet 13 Dec 2023
CVE-2023-34984 CVE record

CVSS 7.1 High

Protection mechanism failure in Fortinet FortiWeb
- Fortinet FortiWeb
- CWE-693
Not analysed yet 13 Sept 2023
CVE-2023-23777 CVE record

CVSS 7.2 High

OS command injection in Fortinet FortiWeb
- Fortinet FortiWeb
- Command injection
Not analysed yet 11 Jul 2023
CVE-2023-33305 CVE record

CVSS 4.9 Medium

Infinite loop in Fortinet FortiWeb and others
- Fortinet FortiWeb
- Fortinet FortiOS
- Denial of service
Not analysed yet 13 Jun 2023
CVE-2022-43955 CVE record

CVSS 8.0 High

Cross-site scripting in Fortinet FortiWeb
- Fortinet FortiWeb
- Cross-site scripting (XSS)
Not analysed yet 11 Apr 2023
CVE-2022-43948 CVE record

CVSS 6.5 Medium

OS command injection in Fortinet FortiWeb and others
- Fortinet FortiWeb
- Fortinet FortiADC
- Command injection
Not analysed yet 11 Apr 2023
CVE-2022-22297 CVE record

CVSS 5.2 Medium

Fortinet FortiRecorder: An incomplete filtering of one or more instances of special elements vulnerability…
- Fortinet FortiRecorder
- Fortinet FortiWeb
- CWE-792
Not analysed yet 7 Mar 2023
CVE-2022-39951 CVE record

CVSS 7.2 High

OS command injection in Fortinet FortiWeb
- Fortinet FortiWeb
- Command injection
Not analysed yet 7 Mar 2023
CVE-2023-22636 CVE record

CVSS 6.6 Medium

Improper authorization in Fortinet FortiWeb
- Fortinet FortiWeb
- Broken access control
Not analysed yet 27 Feb 2023
CVE-2022-40683 CVE record

CVSS 7.1 High

Double free in Fortinet FortiWeb
- Fortinet FortiWeb
- Memory corruption
Not analysed yet 16 Feb 2023
CVE-2023-23778 CVE record

CVSS 4.7 Medium

Path traversal in Fortinet FortiWeb
- Fortinet FortiWeb
- Path traversal
Not analysed yet 16 Feb 2023
CVE-2023-23779 CVE record

CVSS 6.6 Medium

OS command injection in Fortinet FortiWeb
- Fortinet FortiWeb
- Command injection
Not analysed yet 16 Feb 2023
CVE-2022-30306 CVE record

CVSS 6.3 Medium

Stack-based buffer overflow in Fortinet FortiWeb
- Fortinet FortiWeb
- Memory corruption
Not analysed yet 16 Feb 2023
CVE-2022-33871 CVE record

CVSS 6.3 Medium

Stack-based buffer overflow in Fortinet FortiWeb
- Fortinet FortiWeb
- Memory corruption
Not analysed yet 16 Feb 2023
CVE-2023-23781 CVE record

CVSS 6.1 Medium

Stack-based buffer overflow in Fortinet FortiWeb
- Fortinet FortiWeb
- Memory corruption
Not analysed yet 16 Feb 2023
CVE-2023-23782 CVE record

CVSS 7.1 High

Heap-based buffer overflow in Fortinet FortiWeb
- Fortinet FortiWeb
- Memory corruption
Not analysed yet 16 Feb 2023