Fortinet Fortiextender Firmware vulnerabilities

7 CVEs affecting Fortinet Fortiextender Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-64153, published 2025-12-09.

More from Fortinet.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2025-64153, published 2025-12-09. High severity, CVSS 7.2. EPSS: 1.7% chance of exploitation in the next 30 days. A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7.6.0 through 7.6.3, FortiExtender 7.4.0 through 7.4.7, FortiExtender 7.2 all…
• CVE-2022-27489, published 2023-02-16. High severity, CVSS 7.2. EPSS: 1.5% chance of exploitation in the next 30 days. A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7.0.0 through 7.0.3, 5.3.2, 4.2.4 and below allows attacker to execute…
• CVE-2021-41016, published 2022-02-02. High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days. A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiExtender version 7.0.1 and below, 4.2.3 and below, 4.1.7 and below allows an authenticated…
• CVE-2022-23447, published 2023-07-11. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in FortiExtender management interface 7.0.0 through 7.0.3, 4.2.0 through 4.2.4, 4.1.1 through…
• CVE-2024-23663, published 2024-07-09. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. An improper access control in Fortinet FortiExtender 4.1.1 - 4.1.9, 4.2.0 - 4.2.6, 5.3.2, 7.0.0 - 7.0.4, 7.2.0 - 7.2.4 and 7.4.0 - 7.4.2 allows an attacker to create users with elevated privileges…
• CVE-2025-46775, published 2025-11-18. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. A debug messages revealing unnecessary information vulnerability in Fortinet FortiExtender 7.6.0 through 7.6.1, FortiExtender 7.4.0 through 7.4.6, FortiExtender 7.2 all versions, FortiExtender 7.0…
• CVE-2025-46776, published 2025-11-18. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiExtender 7.6.0 through 7.6.1, FortiExtender 7.4.0 through 7.4.6, FortiExtender 7.2 all…