Fortinet Fortiap-U vulnerabilities

7 CVEs affecting Fortinet Fortiap-U, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-53680, published 2026-05-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-15709, published 2020-06-01. Medium severity, CVSS 6.5. EPSS: 1.3% chance of exploitation in the next 30 days. An improper input validation in FortiAP-S/W2 6.2.0 to 6.2.2, 6.0.5 and below, FortiAP-U 6.0.1 and below CLI admin console may allow unauthorized administrators to overwrite system files via specially…
CVE-2023-36634, published 2023-09-13. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiAP-U 7.0.0, 6.2.0 through 6.2.5, 6.0 all versions, 5.4 all…
CVE-2019-15708, published 2020-03-15. Medium severity, CVSS 6.7. EPSS: 0.6% chance of exploitation in the next 30 days. A system command injection vulnerability in the FortiAP-S/W2 6.2.1, 6.2.0, 6.0.5 and below, FortiAP 6.0.5 and below and FortiAP-U below 6.0.0 under CLI admin console may allow unauthorized…
CVE-2023-25608, published 2023-09-13. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiAP-W2 7.2.0 through 7.2.1, 7.0.3 through 7.0.5, 7.0.0 through…
CVE-2025-53680, published 2026-05-12. Medium severity, CVSS 6.7. EPSS: 0.6% chance of exploitation in the next 30 days. An improper neutralization of special elements used in an OS command ("OS Command Injection") vulnerability [CWE-78] vulnerability in Fortinet FortiAP 7.6.0 through 7.6.2, FortiAP 7.4.0 through…
CVE-2022-29058, published 2022-09-06. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. An improper neutralization of special elements [CWE-89] used in an OS command vulnerability [CWE-78] in the command line interpreter of FortiAP 6.0.0 through 6.4.7, 7.0.0 through 7.0.3, 7.2.0,…
CVE-2022-30301, published 2022-07-19. Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days. A path traversal vulnerability [CWE-22] in FortiAP-U CLI 6.2.0 through 6.2.3, 6.0.0 through 6.0.4, 5.4.0 through 5.4.6 may allow an admin user to delete and access unauthorized files and data via…