Fortinet Fortianalyzer Cloud vulnerabilities

20 CVEs affecting Fortinet Fortianalyzer Cloud, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-23707, published 2026-10-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-40584, published 2025-02-11. High severity, CVSS 7.2. EPSS: 2% chance of exploitation in the next 30 days. An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiAnalyzer version 7.4.0 through 7.4.3, 7.2.0 through 7.2.5, 7.0.0…
CVE-2026-22828, published 2026-04-14. High severity, CVSS 8.1. EPSS: 0.9% chance of exploitation in the next 30 days. A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiManager Cloud 7.6.2 through 7.6.4 may allow a remote unauthenticated attacker to execute arbitrary…
CVE-2024-35275, published 2025-01-14. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiAnalyzer version 7.4.0 through 7.4.2, FortiManager version 7.4.0 through 7.4.2 allows attacker…
CVE-2024-35273, published 2025-01-14. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. A out-of-bounds write in Fortinet FortiManager version 7.4.0 through 7.4.2, FortiAnalyzer version 7.4.0 through 7.4.2 allows attacker to escalation of privilege via specially crafted http requests.
CVE-2024-45330, published 2024-10-08. High severity, CVSS 7.2. EPSS: 0.6% chance of exploitation in the next 30 days. A use of externally-controlled format string in Fortinet FortiAnalyzer versions 7.4.0 through 7.4.3, 7.2.2 through 7.2.5 allows attacker to escalate its privileges via specially crafted requests.
CVE-2025-68648, published 2026-03-10. High severity, CVSS 7.2. EPSS: 0.6% chance of exploitation in the next 30 days. A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all…
CVE-2024-50563, published 2025-01-16. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. A weak authentication in Fortinet FortiManager Cloud, FortiAnalyzer versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiAnalyzer Cloud versions 7.4.1 through 7.4.3, FortiManager versions 7.6.0…
CVE-2025-48418, published 2026-03-10. High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days. A hidden functionality vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.3, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2.0 through 7.2.10, FortiAnalyzer 7.0.0 through 7.0.14,…
CVE-2024-50571, published 2025-10-14. High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days. A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.0 through 7.4.5, FortiAnalyzer 7.2.0 through 7.2.9, FortiAnalyzer 7.0.0 through 7.0.13,…
CVE-2025-61848, published 2026-04-14. High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days. An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.8, FortiAnalyzer…

Latest

CVE-2026-23707, published 2026-10-13. High severity, CVSS 7.2. EPSS: 0.3% chance of exploitation in the next 30 days. An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through…
CVE-2026-23706, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through…
CVE-2025-46773, published 2026-10-13. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through…
CVE-2025-68649, published 2026-04-14. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all…
CVE-2026-22629, published 2026-03-10. Low severity, CVSS 3.7. EPSS: 0.4% chance of exploitation in the next 30 days. An improper restriction of excessive authentication attempts vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4 all versions, FortiAnalyzer 7.2 all versions, FortiAnalyzer…