Fortinet Fortianalyzer Big Data vulnerabilities

13 CVEs affecting Fortinet Fortianalyzer Big Data, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-49784, published 2026-03-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-23666, published 2024-11-12. High severity, CVSS 8.8. EPSS: 2.7% chance of exploitation in the next 30 days. A client-side enforcement of server-side security in Fortinet FortiAnalyzer-BigData at least version 7.4.0 and 7.2.0 through 7.2.6 and 7.0.1 through 7.0.6 and 6.4.5 through 6.4.7 and 6.2.5,…
CVE-2024-40584, published 2025-02-11. High severity, CVSS 7.2. EPSS: 2% chance of exploitation in the next 30 days. An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiAnalyzer version 7.4.0 through 7.4.3, 7.2.0 through 7.2.5, 7.0.0…
CVE-2024-32117, published 2024-11-12. Medium severity, CVSS 4.9. EPSS: 0.9% chance of exploitation in the next 30 days. An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiManager version 7.4.0 through 7.4.2 and below 7.2.5, FortiAnalyzer version…
CVE-2024-32118, published 2024-11-12. Medium severity, CVSS 6.7. EPSS: 0.6% chance of exploitation in the next 30 days. Multiple improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilities [CWE-78] in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5,…
CVE-2023-44255, published 2024-11-12. Medium severity, CVSS 4.1. EPSS: 0.6% chance of exploitation in the next 30 days. An exposure of sensitive information to an unauthorized actor [CWE-200] in Fortinet FortiManager before 7.4.2, FortiAnalyzer before 7.4.2 and FortiAnalyzer-BigData before 7.2.5 may allow a privileged…
CVE-2023-44254, published 2024-09-10. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. An authorization bypass through user-controlled key [CWE-639] vulnerability in FortiAnalyzer version 7.4.1 and before 7.2.5 and FortiManager version 7.4.1 and before 7.2.5 may allow a remote attacker…
CVE-2025-49784, published 2026-03-10. High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days. An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer…
CVE-2024-32123, published 2025-03-11. Medium severity, CVSS 6.7. EPSS: 0.4% chance of exploitation in the next 30 days. Multiple improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiManager, FortiAnalyzer versions 7.4.0 through 7.4.2 7.2.0 through 7.2.5 and 7.0.0…
CVE-2024-32116, published 2024-11-12. Medium severity, CVSS 6.0. EPSS: 0.2% chance of exploitation in the next 30 days. Multiple relative path traversal vulnerabilities [CWE-23] in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5, FortiAnalyzer version 7.4.0 through 7.4.2 and before 7.2.5 and…
CVE-2024-35274, published 2024-11-12. Low severity, CVSS 2.3. EPSS: 0.2% chance of exploitation in the next 30 days. An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiAnalyzer versions below 7.4.2, Fortinet FortiManager versions below 7.4.2 and…

Latest

CVE-2024-33501, published 2025-03-11. Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days. Two improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in Fortinet FortiAnalyzer version 7.4.0 through 7.4.2 and before 7.2.5, FortiManager…
CVE-2024-31496, published 2024-11-12. Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days. A stack-based buffer overflow vulnerability [CWE-121] in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5, FortiAnalyzer version 7.4.0 through 7.4.2 and before 7.2.5 and…