Fortinet Fortideceptor vulnerabilities

11 CVEs affecting Fortinet Fortideceptor, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-25690, published 2026-05-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-29017, published 2021-01-14. High severity, CVSS 8.8. EPSS: 3.7% chance of exploitation in the next 30 days. An OS command injection vulnerability in FortiDeceptor 3.1.0, 3.0.1, 3.0.0 may allow a remote authenticated attacker to execute arbitrary commands on the system by exploiting a command injection…
CVE-2023-26209, published 2023-03-09. Medium severity, CVSS 5.3. EPSS: 1.7% chance of exploitation in the next 30 days. A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiDeceptor 3.1.x and before allows a remote unauthenticated attacker to partially exhaust CPU and…
CVE-2020-6644, published 2020-06-22. High severity, CVSS 8.1. EPSS: 1% chance of exploitation in the next 30 days. An insufficient session expiration vulnerability in FortiDeceptor 3.0.0 and below allows an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be…
CVE-2022-27487, published 2023-04-11. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. A improper privilege management in Fortinet FortiSandbox version 4.2.0 through 4.2.2, 4.0.0 through 4.0.2 and before 3.2.3 and FortiDeceptor version 4.1.0, 4.0.0 through 4.0.2 and before 3.3.3 allows…
CVE-2022-30302, published 2022-07-19. High severity, CVSS 8.1. EPSS: 0.9% chance of exploitation in the next 30 days. Multiple relative path traversal vulnerabilities [CWE-23] in FortiDeceptor management interface 1.0.0 through 3.2.x, 3.3.0 through 3.3.2, 4.0.0 through 4.0.1 may allow a remote and authenticated…
CVE-2022-30305, published 2022-12-06. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. An insufficient logging [CWE-778] vulnerability in FortiSandbox versions 4.0.0 to 4.0.2, 3.2.0 to 3.2.3 and 3.1.0 to 3.1.5 and FortiDeceptor versions 4.2.0, 4.1.0 through 4.1.1, 4.0.0 through 4.0.2,…
CVE-2026-25689, published 2026-03-10. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor 6.2.0, FortiDeceptor 6.0 all versions, FortiDeceptor 5.3 all versions,…
CVE-2022-38373, published 2022-11-02. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiDeceptor management interface 4.2.0, 4.1.0 through 4.1.1, 4.0.2 may allow an authenticated user to…
CVE-2026-25690, published 2026-05-12. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor 6.0.0 through 6.0.2, FortiDeceptor 5.3.0 through 5.3.3, FortiDeceptor…
CVE-2024-35280, published 2025-01-15. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiDeceptor 5.3.0, FortiDeceptor 5.2.0, FortiDeceptor 5.1 all versions,…

Latest

CVE-2024-45326, published 2025-01-14. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. An Improper Access Control vulnerability [CWE-284] vulnerability in Fortinet FortiDeceptor 6.0.0, FortiDeceptor 5.3 all versions, FortiDeceptor 5.2 all versions, FortiDeceptor 5.1 all versions,…