CVE-2023-28001: Fortinet FortiOS

Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days.

An insufficient session expiration in Fortinet FortiOS 7.0.0 - 7.0.12 and 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or commands via reusing the session of a deleted user in the REST API.

Affected products

• Fortinet FortiOS: from 7.0.0, up to and including 7.0.12; from 7.2.0, up to and including 7.2.4

Published 2023-07-11. Last modified 2026-06-17.