Intelligence online17 sources monitored8 actively exploited 7d26 published 24hChecked recently
Product

FortiGate / FortiOS

Made by Fortinet. 13 of its vulnerabilities are known to have been exploited.

Coverage

CriticalAct nowExploitedCISA KEV

Fortinet FortiMail Path Traversal Vulnerability (CVE-2026-104286) is being actively exploited, CISA warns

CISA added CVE-2026-104286 (Fortinet FortiMail) to its Known Exploited Vulnerabilities catalog on October 1, 2026, which means there is reliable evidence of exploitation in the wild. Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or…

Why it matters

CISA lists this as exploited in the wild. Unpatched FortiGate / FortiOS and FortiMail systems are exposed to active attacks now.

Act now

Treat this as an emergency.

CISA Known Exploited Vulnerabilities · 5 sources
SMBEnterpriseSecurity pros

Recent intelligence

The latest developments from the last 30 days, newest first.

  1. Severity raisedUpdateKEV

    UPDATE: severity raised to critical: Fortinet FortiMail Path Traversal Vulnerability (CVE-2026-104286) is being actively exploited, CISA warns

    Basis: CISA Known Exploited Vulnerabilities (government advisory)

  2. AdvisoryKEV

    Fortinet FortiMail Path Traversal Vulnerability (CVE-2026-104286) is being actively exploited, CISA warns

    Basis: CISA Known Exploited Vulnerabilities (government advisory)

Actively exploited

CVE-2025-68686CVSS 5.9

Fortinet FortiOS

Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

Added Jul 27, 2026Fed. due Aug 10, 2026
CVE-2025-58034CVSS 7.2

Fortinet FortiWeb

Fortinet FortiWeb OS Command Injection Vulnerability

Added Nov 18, 2025Fed. due Nov 25, 2025
CVE-2025-64446CVSS 9.8

Fortinet FortiWeb

Fortinet FortiWeb Path Traversal Vulnerability

Added Nov 14, 2025Fed. due Nov 21, 2025
CVE-2025-25257CVSS 9.8

Fortinet FortiWeb

Fortinet FortiWeb SQL Injection Vulnerability

Added Jul 18, 2025Fed. due Aug 8, 2025
CVE-2019-6693RansomwareCVSS 6.5

Fortinet FortiOS

Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability

Added Jun 25, 2025Fed. due Jul 16, 2025
CVE-2024-47575CVSS 9.8

Fortinet FortiManager

Fortinet FortiManager Missing Authentication Vulnerability

Added Oct 23, 2024Fed. due Nov 13, 2024
CVE-2024-21762RansomwareCVSS 9.8

Fortinet FortiOS

Fortinet FortiOS Out-of-Bound Write Vulnerability

Added Feb 9, 2024Fed. due Feb 16, 2024
CVE-2022-41328CVSS 7.1

Fortinet FortiOS

Fortinet FortiOS Path Traversal Vulnerability

Added Mar 14, 2023Fed. due Apr 4, 2023
CVE-2022-42475RansomwareCVSS 9.8

Fortinet FortiOS

Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability

Added Dec 13, 2022Fed. due Jan 3, 2023
CVE-2021-44168CVSS 7.8

Fortinet FortiOS

Fortinet FortiOS Arbitrary File Download

Added Dec 10, 2021Fed. due Dec 24, 2021
CVE-2018-13379RansomwareCVSS 9.8

Fortinet FortiOS

Fortinet FortiOS SSL VPN Path Traversal Vulnerability

Added Nov 3, 2021Fed. due May 3, 2022
CVE-2020-12812RansomwareCVSS 9.8

Fortinet FortiOS

Fortinet FortiOS SSL VPN Improper Authentication Vulnerability

Added Nov 3, 2021Fed. due May 3, 2022
CVE-2019-5591RansomwareCVSS 6.5

Fortinet FortiOS

Fortinet FortiOS Default Configuration Vulnerability

Added Nov 3, 2021Fed. due May 3, 2022