Fortinet Fortiap vulnerabilities

7 CVEs affecting Fortinet Fortiap, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-53870, published 2026-05-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-26012, published 2025-01-14. High severity, CVSS 7.8. EPSS: 0.7% chance of exploitation in the next 30 days. A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiAP-S 6.2 all verisons, and 6.4.0 through 6.4.9, FortiAP-W2 6.4 all versions, 7.0 all…
CVE-2019-15708, published 2020-03-15. Medium severity, CVSS 6.7. EPSS: 0.6% chance of exploitation in the next 30 days. A system command injection vulnerability in the FortiAP-S/W2 6.2.1, 6.2.0, 6.0.5 and below, FortiAP 6.0.5 and below and FortiAP-U below 6.0.0 under CLI admin console may allow unauthorized…
CVE-2023-25608, published 2023-09-13. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiAP-W2 7.2.0 through 7.2.1, 7.0.3 through 7.0.5, 7.0.0 through…
CVE-2025-53870, published 2026-05-12. Medium severity, CVSS 6.7. EPSS: 0.6% chance of exploitation in the next 30 days. An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAP 7.6.0 through 7.6.2, FortiAP 7.4.0 through 7.4.5, FortiAP 7.2 all…
CVE-2025-53680, published 2026-05-12. Medium severity, CVSS 6.7. EPSS: 0.6% chance of exploitation in the next 30 days. An improper neutralization of special elements used in an OS command ("OS Command Injection") vulnerability [CWE-78] vulnerability in Fortinet FortiAP 7.6.0 through 7.6.2, FortiAP 7.4.0 through…
CVE-2022-29058, published 2022-09-06. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. An improper neutralization of special elements [CWE-89] used in an OS command vulnerability [CWE-78] in the command line interpreter of FortiAP 6.0.0 through 6.4.7, 7.0.0 through 7.0.3, 7.2.0,…
CVE-2021-26106, published 2021-07-09. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. An improper neutralization of special elements used in an OS Command vulnerability in FortiAP's console 6.4.1 through 6.4.5 and 6.2.4 through 6.2.5 may allow an authenticated attacker to execute…