# Fortinet vulnerabilities Source: https://junglewise.ai/threats/vendors/fortinet Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/fortinet.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 262 vulnerabilities in Fortinet: 97 in the last 7 days and 120 in the last 90 days, 59 of them critical and 31 exploited in the wild. The most recent, CVE-2026-126263, was published on 11 November 2026. 11 vulnerabilities in the last four weeks, up 450% on the four before (2). 2 critical against 2, 0 exploited in the wild against 1. 29 technologies have a page of their own. ## Counts - Last 7 days: 97 - Last 30 days: 99 - Last 90 days: 120 - All time: 262 (59 critical, 31 exploited in the wild) ## About Fortinet A multinational corporation that develops and sells cybersecurity solutions, including firewalls, endpoint security, and network security software. ## Latest Fortinet vulnerabilities - [CVE-2026-126263: Fortinet FortiMail SQL injection](https://junglewise.ai/threats/cve-2026-126263-a-improper-neutralization-of-special-elements-used-in-an-sql) (critical, CVSS 9.8, published 11 Nov 2026) - [CVE-2026-126262: Fortinet FortiAnalyzer and FortiManager SQL injection in OFTP](https://junglewise.ai/threats/cve-2026-126262-a-improper-neutralization-of-special-elements-used-in-an-sql) (critical, CVSS 9.8, published 11 Nov 2026) - [CVE-2026-126259: Fortinet FortiOS authentication bypass in HA command execution](https://junglewise.ai/threats/cve-2026-126259-a-missing-authentication-for-critical-function-vulnerability-in) (critical, CVSS 9.8, published 11 Nov 2026) - [CVE-2026-126258: Fortinet FortiOS stack buffer overflow in WAD proxy](https://junglewise.ai/threats/cve-2026-126258-a-stack-based-buffer-overflow-vulnerability-in-fortinet-fortios) (high, CVSS 7.5, published 11 Nov 2026) - [CVE-2026-126257: Fortinet FortiAuthenticator hard-coded password authentication bypass](https://junglewise.ai/threats/cve-2026-126257-a-use-of-hard-coded-password-vulnerability-in-fortinet) (critical, CVSS 9, published 11 Nov 2026) - [CVE-2026-126256: Fortinet FortiOS out-of-bounds read in kernel](https://junglewise.ai/threats/cve-2026-126256-a-out-of-bounds-read-vulnerability-in-fortinet-fortios-8-0-0) (high, CVSS 7.4, published 11 Nov 2026) - [CVE-2026-126255: Fortinet FortiOS path traversal authentication bypass in SSH daemon](https://junglewise.ai/threats/cve-2026-126255-a-path-traversal-filedir-vulnerability-in-fortinet-fortios-8-0-0) (high, CVSS 7.4, published 11 Nov 2026) - [CVE-2026-126254: Fortinet FortiOS numeric truncation error in BGP daemon](https://junglewise.ai/threats/cve-2026-126254-a-numeric-truncation-error-vulnerability-in-fortinet-fortios-8-0) (critical, CVSS 9.6, published 11 Nov 2026) - [CVE-2026-126253: Fortinet FortiOS authentication bypass in OSPF daemon](https://junglewise.ai/threats/cve-2026-126253-a-authentication-bypass-by-primary-weakness-vulnerability-in) (critical, CVSS 9.3, published 11 Nov 2026) - [CVE-2026-126252: Fortinet FortiAuthenticator SQL injection](https://junglewise.ai/threats/cve-2026-126252-a-improper-neutralization-of-special-elements-used-in-an-sql) (high, CVSS 8.3, published 11 Nov 2026) - [CVE-2026-126251: Fortinet FortiAuthenticator incorrect authorization](https://junglewise.ai/threats/cve-2026-126251-a-incorrect-authorization-vulnerability-in-fortinet) (critical, CVSS 9.1, published 11 Nov 2026) - [CVE-2026-126250: Fortinet FortiAuthenticator authorization bypass DoS](https://junglewise.ai/threats/cve-2026-126250-a-incorrect-authorization-vulnerability-in-fortinet) (high, CVSS 8.2, published 11 Nov 2026) - [CVE-2026-126249: Fortinet FortiAuthenticator privilege escalation in GUI](https://junglewise.ai/threats/cve-2026-126249-a-improper-privilege-management-vulnerability-in-fortinet) (high, CVSS 7.2, published 11 Nov 2026) - [CVE-2026-126248: Fortinet FortiAuthenticator insufficiently protected credentials](https://junglewise.ai/threats/cve-2026-126248-a-insufficiently-protected-credentials-vulnerability-in-fortinet) (high, CVSS 7.5, published 11 Nov 2026) - [CVE-2026-126247: Fortinet FortiAuthenticator format string code execution](https://junglewise.ai/threats/cve-2026-126247-a-use-of-externally-controlled-format-string-vulnerability-in) (high, CVSS 7.2, published 11 Nov 2026) - [CVE-2026-126246: Fortinet FortiAuthenticator null pointer dereference](https://junglewise.ai/threats/cve-2026-126246-a-null-pointer-dereference-vulnerability-in-fortinet) (high, CVSS 7.5, published 11 Nov 2026) - [CVE-2026-126245: Fortinet FortiAuthenticator out-of-bounds write in API](https://junglewise.ai/threats/cve-2026-126245-a-out-of-bounds-write-vulnerability-in-fortinet) (high, CVSS 8.1, published 11 Nov 2026) - [CVE-2026-126244: Fortinet FortiAuthenticator resource exhaustion denial of service](https://junglewise.ai/threats/cve-2026-126244-a-allocation-of-resources-without-limits-or-throttling) (high, CVSS 7.5, published 11 Nov 2026) - [CVE-2026-126243: Fortinet FortiAuthenticator incorrect authorization](https://junglewise.ai/threats/cve-2026-126243-a-incorrect-authorization-vulnerability-in-fortinet) (high, CVSS 7.2, published 11 Nov 2026) - [CVE-2026-126242: Fortinet FortiAuthenticator incorrect authorization in API](https://junglewise.ai/threats/cve-2026-126242-a-incorrect-authorization-vulnerability-in-fortinet) (high, CVSS 7.4, published 11 Nov 2026) - [CVE-2026-126241: Fortinet FortiAuthenticator SQL injection in API](https://junglewise.ai/threats/cve-2026-126241-a-improper-neutralization-of-special-elements-used-in-an-sql) (high, CVSS 8.8, published 11 Nov 2026) - [CVE-2026-126240: Fortinet FortiAuthenticator LDAP injection authentication bypass](https://junglewise.ai/threats/cve-2026-126240-a-improper-neutralization-of-special-elements-used-in-an-ldap) (high, CVSS 8.2, published 11 Nov 2026) - [CVE-2026-126239: Fortinet FortiAuthenticator stack-based buffer overflow](https://junglewise.ai/threats/cve-2026-126239-a-stack-based-buffer-overflow-vulnerability-in-fortinet) (high, CVSS 7.5, published 11 Nov 2026) - [CVE-2026-126238: Fortinet FortiAuthenticator incorrect authorization in REST API](https://junglewise.ai/threats/cve-2026-126238-a-incorrect-authorization-vulnerability-in-fortinet) (high, CVSS 8.6, published 11 Nov 2026) - [CVE-2026-126237: Fortinet FortiAuthenticator infinite loop denial of service](https://junglewise.ai/threats/cve-2026-126237-a-loop-with-unreachable-exit-condition-infinite-loop) (high, CVSS 7.5, published 11 Nov 2026) ## Most severe Fortinet vulnerabilities - [CVE-2025-64446: Fortinet FortiWeb path traversal and command execution](https://junglewise.ai/threats/cve-2025-64446-fortinet-fortiweb-path-traversal-and-command-execution) (critical, exploited in the wild, CVSS 9.8, published 14 Nov 2025) - [CVE-2026-35616: Fortinet FortiClientEMS improper access control in API](https://junglewise.ai/threats/cve-2026-35616-fortinet-forticlientems-improper-access-control-in-api) (critical, exploited in the wild, CVSS 9.8, published 4 Apr 2026) - [CVE-2026-21643: Fortinet FortiClient EMS SQL injection](https://junglewise.ai/threats/cve-2026-21643-fortinet-forticlient-ems-sql-injection) (critical, exploited in the wild, CVSS 9.8, published 13 Apr 2026) - [CVE-2026-39808: Fortinet FortiSandbox OS command injection in API endpoint](https://junglewise.ai/threats/cve-2026-39808-fortinet-fortisandbox-os-command-injection-in-api-endpoint) (critical, exploited in the wild, CVSS 9.8, published 14 Apr 2026) - [CVE-2025-25257: Fortinet FortiWeb SQL injection](https://junglewise.ai/threats/cve-2025-25257-fortinet-fortiweb-sql-injection) (critical, exploited in the wild, CVSS 9.8, published 18 Jul 2025) - [CVE-2026-25089: Fortinet FortiSandbox OS command injection in Web UI](https://junglewise.ai/threats/cve-2026-25089-fortinet-fortisandbox-os-command-injection-in-web-ui) (critical, exploited in the wild, CVSS 9.8, published 9 Jun 2026) - [CVE-2025-59718: Fortinet Multiple Products auth bypass via improper SAML signature verification](https://junglewise.ai/threats/cve-2025-59718-fortinet-multiple-products-auth-bypass-via-improper-saml) (critical, exploited in the wild, CVSS 9.8, published 9 Dec 2025) - [CVE-2026-24858: Fortinet Multiple Products authentication bypass in FortiCloud SSO](https://junglewise.ai/threats/cve-2026-24858-fortinet-multiple-products-authentication-bypass-in-forticloud) (critical, exploited in the wild, CVSS 9.8, published 27 Jan 2026) - [CVE-2026-104286: Fortinet FortiMail path traversal vulnerability](https://junglewise.ai/threats/cve-2026-104286-fortinet-fortimail-path-traversal-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 1 Oct 2026) - [CVE-2024-55591: Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability](https://junglewise.ai/threats/cve-2024-55591-fortinet-fortios-and-fortiproxy-authentication-bypass) (critical, exploited in the wild, CVSS 9.8, published 14 Jan 2025) ## Vulnerabilities per week 11 vulnerabilities in the last four weeks, up 450% on the four before (2). 2 critical against 2, 0 exploited in the wild against 1. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 10 | 2 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 1 | 1 | 0 | | 28 Sep 2026 | 1 | 1 | 1 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 9 | 1 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 2 | 1 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 97 | 18 | 0 | ## Fortinet technologies - [Fortinet FortiOS](https://junglewise.ai/threats/technologies/fortios): 66 vulnerabilities - [Fortinet FortiManager](https://junglewise.ai/threats/technologies/fortimanager): 54 vulnerabilities - [Fortinet FortiManager Cloud](https://junglewise.ai/threats/technologies/fortimanager-cloud): 48 vulnerabilities - [Fortinet FortiAnalyzer](https://junglewise.ai/threats/technologies/fortianalyzer): 47 vulnerabilities - [Fortinet Fortianalyzer Cloud](https://junglewise.ai/threats/technologies/fortianalyzer-cloud): 42 vulnerabilities - [Fortinet FortiProxy](https://junglewise.ai/threats/technologies/fortiproxy): 35 vulnerabilities - [Fortinet FortiMail](https://junglewise.ai/threats/technologies/fortimail): 31 vulnerabilities - [Fortinet FortiAuthenticator](https://junglewise.ai/threats/technologies/fortiauthenticator): 22 vulnerabilities - [Fortinet FortiSandbox](https://junglewise.ai/threats/technologies/fortisandbox): 17 vulnerabilities - [Fortinet FortiWeb](https://junglewise.ai/threats/technologies/fortiweb): 16 vulnerabilities - [Fortinet Fortisase](https://junglewise.ai/threats/technologies/fortisase): 13 vulnerabilities - [Fortinet FortiPAM](https://junglewise.ai/threats/technologies/fortipam): 12 vulnerabilities - [Fortinet FortiSandbox Cloud](https://junglewise.ai/threats/technologies/fortisandbox-cloud): 12 vulnerabilities - [Fortinet FortiADC](https://junglewise.ai/threats/technologies/fortiadc): 11 vulnerabilities - [Fortinet FortiSOAR](https://junglewise.ai/threats/technologies/fortisoar): 11 vulnerabilities - [Fortinet FortiSwitchManager](https://junglewise.ai/threats/technologies/fortiswitchmanager): 9 vulnerabilities - [Fortinet FortiProxy SSL-VPN](https://junglewise.ai/threats/technologies/fortiproxy-ssl-vpn): 7 vulnerabilities - [Fortinet FortiSandbox PaaS](https://junglewise.ai/threats/technologies/fortisandbox-paas): 7 vulnerabilities - [Fortinet Forticlient](https://junglewise.ai/threats/technologies/forticlient): 5 vulnerabilities - [Fortinet FortiGate NGFW](https://junglewise.ai/threats/technologies/fortigate-ngfw): 5 vulnerabilities - [Fortinet FortiSASE-Sovereign](https://junglewise.ai/threats/technologies/fortisase-sovereign): 5 vulnerabilities - [Fortinet FortiSIEM](https://junglewise.ai/threats/technologies/fortisiem): 5 vulnerabilities - [Fortinet FortiClient EMS](https://junglewise.ai/threats/technologies/forticlient-ems): 4 vulnerabilities - [Fortinet FortiClientEMS](https://junglewise.ai/threats/technologies/forticlientems): 4 vulnerabilities - [Fortinet Fortidlp Agent](https://junglewise.ai/threats/technologies/fortidlp-agent): 4 vulnerabilities - [Fortinet Fortiextender](https://junglewise.ai/threats/technologies/fortiextender): 3 vulnerabilities - [Fortinet Fortiextender Firmware](https://junglewise.ai/threats/technologies/fortiextender-firmware): 3 vulnerabilities - [Fortinet FortiSOAR PaaS](https://junglewise.ai/threats/technologies/fortisoar-paas): 3 vulnerabilities - [Fortinet Fortivoice](https://junglewise.ai/threats/technologies/fortivoice): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Fortinet vulnerabilities", https://junglewise.ai/threats/vendors/fortinet, 13 November 2026.