Intelligence online17 sources monitored8 actively exploited 7d26 published 24hChecked recently
Vendor

Fortinet

31 known exploitedOfficial security advisories

Fortinet news

CriticalAct nowExploitedCISA KEV

Fortinet FortiMail Path Traversal Vulnerability (CVE-2026-104286) is being actively exploited, CISA warns

CISA added CVE-2026-104286 (Fortinet FortiMail) to its Known Exploited Vulnerabilities catalog on October 1, 2026, which means there is reliable evidence of exploitation in the wild. Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or…

Why it matters

CISA lists this as exploited in the wild. Unpatched FortiGate / FortiOS and FortiMail systems are exposed to active attacks now.

Act now

Treat this as an emergency.

CISA Known Exploited Vulnerabilities · 5 sources
SMBEnterpriseSecurity pros

Recent intelligence

The latest developments from the last 30 days, newest first.

  1. Severity raisedUpdateKEV

    UPDATE: severity raised to critical: Fortinet FortiMail Path Traversal Vulnerability (CVE-2026-104286) is being actively exploited, CISA warns

    Basis: CISA Known Exploited Vulnerabilities (government advisory)

  2. AdvisoryKEV

    Fortinet FortiMail Path Traversal Vulnerability (CVE-2026-104286) is being actively exploited, CISA warns

    Basis: CISA Known Exploited Vulnerabilities (government advisory)

  3. Added to CISA KEVCVE-2026-104286

    CVE-2026-104286 added to CISA KEV: Fortinet FortiMail, Fortinet FortiMail Path Traversal Vulnerability

    Basis: CISA Known Exploited Vulnerabilities catalog

Actively exploited

All 31 →
CVE-2025-25249CVSS 9.8

Fortinet Multiple Products

Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability

Added Sep 9, 2026Fed. due Sep 12, 2026
CVE-2025-68686CVSS 5.9

Fortinet FortiOS

Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

Added Jul 27, 2026Fed. due Aug 10, 2026
CVE-2026-25089CVSS 9.8

Fortinet FortiSandbox

Fortinet FortiSandbox OS Command Injection Vulnerability

Added Jul 16, 2026Fed. due Jul 19, 2026
CVE-2026-39808CVSS 9.8

Fortinet FortiSandbox

Fortinet FortiSandbox OS Command Injection Vulnerability

Added Jul 16, 2026Fed. due Jul 19, 2026
CVE-2026-21643CVSS 9.8

Fortinet FortiClient EMS

Fortinet FortiClient EMS SQL Injection Vulnerability

Added Apr 13, 2026Fed. due Apr 16, 2026
CVE-2026-35616CVSS 9.8

Fortinet FortiClient EMS

Fortinet FortiClient EMS Improper Access Control Vulnerability

Added Apr 6, 2026Fed. due Apr 9, 2026
CVE-2026-24858CVSS 9.8

Fortinet Multiple Products

Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability

Added Jan 27, 2026Fed. due Jan 30, 2026
CVE-2025-59718CVSS 9.8

Fortinet Multiple Products

Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability

Added Dec 16, 2025Fed. due Dec 23, 2025
CVE-2025-58034CVSS 7.2

Fortinet FortiWeb

Fortinet FortiWeb OS Command Injection Vulnerability

Added Nov 18, 2025Fed. due Nov 25, 2025
CVE-2025-64446CVSS 9.8

Fortinet FortiWeb

Fortinet FortiWeb Path Traversal Vulnerability

Added Nov 14, 2025Fed. due Nov 21, 2025
CVE-2025-25257CVSS 9.8

Fortinet FortiWeb

Fortinet FortiWeb SQL Injection Vulnerability

Added Jul 18, 2025Fed. due Aug 8, 2025
CVE-2019-6693RansomwareCVSS 6.5

Fortinet FortiOS

Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability

Added Jun 25, 2025Fed. due Jul 16, 2025
CVE-2025-32756CVSS 9.8

Fortinet Multiple Products

Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability

Added May 14, 2025Fed. due Jun 4, 2025
CVE-2025-24472RansomwareCVSS 8.1

Fortinet FortiOS and FortiProxy

Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

Added Mar 18, 2025Fed. due Apr 8, 2025
CVE-2024-55591RansomwareCVSS 9.8

Fortinet FortiOS and FortiProxy

Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

Added Jan 14, 2025Fed. due Jan 21, 2025
CVE-2024-47575CVSS 9.8

Fortinet FortiManager

Fortinet FortiManager Missing Authentication Vulnerability

Added Oct 23, 2024Fed. due Nov 13, 2024
CVE-2024-23113CVSS 9.8

Fortinet Multiple Products

Fortinet Multiple Products Format String Vulnerability

Added Oct 9, 2024Fed. due Oct 30, 2024
CVE-2023-48788RansomwareCVSS 9.8

Fortinet FortiClient EMS

Fortinet FortiClient EMS SQL Injection Vulnerability

Added Mar 25, 2024Fed. due Apr 15, 2024
CVE-2024-21762RansomwareCVSS 9.8

Fortinet FortiOS

Fortinet FortiOS Out-of-Bound Write Vulnerability

Added Feb 9, 2024Fed. due Feb 16, 2024

Products

FortiGate / FortiOS · 13 KEVMultiple Products · 6 KEVFortiOS and FortiProxy · 4 KEVFortiClient EMS · 3 KEVFortiSandbox · 2 KEVFortiMail · 1 KEVFortiOS and FortiADC · 1 KEVFortiOS and FortiProxy SSL-VPN · 1 KEV