CVE-2021-36173: Fortinet FortiOS

High severity, CVSS 8.8. EPSS: 1.5% chance of exploitation in the next 30 days.

A heap-based buffer overflow in the firmware signature verification function of FortiOS versions 7.0.1, 7.0.0, 6.4.0 through 6.4.6, 6.2.0 through 6.2.9, and 6.0.0 through 6.0.13 may allow an attacker to execute arbitrary code via specially crafted installation images.

Affected products

• Fortinet FortiOS: from 6.0.0, up to and including 6.0.13; from 6.2.0, up to and including 6.2.9; from 6.4.0, up to and including 6.4.6; version 7.0.0 only; version 7.0.1 only

Published 2021-12-08. Last modified 2026-06-17.