Short answer: this page lists every Fortinet vulnerability that CISA added to its Known Exploited Vulnerabilities (KEV) catalog in 2026, meaning there is evidence of exploitation in the wild, with the fix and a link to our Daily Brief coverage where we wrote about it. If you run any product in the table, treat its row as a patch-now item.
How to use this page
- Match products first. Compare the Product column with your asset inventory. Only rows for products and versions you run matter to you.
- Patch newest and internet-facing first. Rows are sorted by the date CISA added them. Recently added flaws on exposed systems are usually the most urgent.
- Use the Fix column. It shows CISA’s required action and links to Fortinet’s advisory (or the NVD entry when CISA lists no advisory) for fixed versions and workarounds.
- Check for compromise, not just patch status. Where we covered a flaw, the Our coverage link has exposure checks and what to hunt for. Patching does not remove an attacker who is already in.
- U.S. federal agencies must remediate KEV entries by the due date CISA sets; everyone else can use KEV as a priority list.
Fortinet vulnerabilities exploited in 2026
As of 2026-10-23 (CISA KEV catalog version 2026.10.23), CISA lists 9 Fortinet vulnerabilities added to the Known Exploited Vulnerabilities catalog in 2026. CyberExperts has covered 4 of them in the Daily Brief. Newest additions are first.
| CVE | Product | Added to KEV | Fix | Our coverage |
|---|---|---|---|---|
| CVE-2025-61624 | Multiple Products Fortinet Multiple Products Path Traversal Vulnerability | 2026-10-16 | Apply the vendor's updates or mitigations. Vendor advisory | Stolen FortiGate admin passwords are turning into full firewall takeovers. Upgrade FortiOS and change them |
| CVE-2026-104286 | FortiMail Fortinet FortiMail Path Traversal Vulnerability | 2026-10-01 | Apply the vendor's updates or mitigations. Vendor advisory | Friday’s brief: FortiMail due Saturday, then BoKS, vm2, Satellite Your FortiMail management plane has a Saturday deadline |
| CVE-2025-25249 | Multiple Products Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability | 2026-09-09 | Apply the vendor's updates or mitigations. Vendor advisory | Fortinet CVE-2025-25249: PivotC2 Node.js RAT on FortiGate after cw_acd RCE The 5-Minute Cyber Brief: September 11, 2026 Fortinet FortiOS CVE-2025-25249: CAPWAP Heap Overflow to PivotC2 RAT |
| CVE-2025-68686 | FortiOS Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability | 2026-07-27 | Apply the vendor's updates or mitigations. Vendor advisory | Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw CISA Adds Two Known Exploited Vulnerabilities to Catalog The 5-Minute Cyber Brief: July 28, 2026 |
| CVE-2026-39808 | FortiSandbox Fortinet FortiSandbox OS Command Injection Vulnerability | 2026-07-16 | Apply the vendor's updates or mitigations. Vendor advisory | Not covered yet |
| CVE-2026-25089 | FortiSandbox Fortinet FortiSandbox OS Command Injection Vulnerability | 2026-07-16 | Apply the vendor's updates or mitigations. Vendor advisory | Not covered yet |
| CVE-2026-21643 | FortiClient EMS Fortinet FortiClient EMS SQL Injection Vulnerability | 2026-04-13 | Apply the vendor's updates or mitigations. Vendor advisory | Not covered yet |
| CVE-2026-35616 | FortiClient EMS Fortinet FortiClient EMS Improper Access Control Vulnerability | 2026-04-06 | Apply the vendor's updates or mitigations. Vendor advisory | Not covered yet |
| CVE-2026-24858 | Multiple Products Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability | 2026-01-27 | Apply the vendor's updates or mitigations. Vendor advisory | Not covered yet |
How this page is built
The table is compiled from CISA’s Known Exploited Vulnerabilities catalog and our own Daily Brief coverage, and we refresh it as CISA adds entries. A missing row means CISA has not added that flaw to KEV this year, not that it is safe to ignore. Always confirm fixed versions in the vendor advisory.