Fortinet FortiManager Cloud vulnerabilities

31 CVEs affecting Fortinet FortiManager Cloud, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-23707, published 2026-10-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-47575: Fortinet FortiManager Missing Authentication Vulnerability, published 2024-10-23. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2024-10-23. EPSS: 94.8% chance of exploitation in the next 30 days. A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through…
CVE-2024-48884, published 2025-01-14. Critical severity, CVSS 9.1. EPSS: 15.3% chance of exploitation in the next 30 days. A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.1 through 7.4.3, FortiManager Cloud 7.4.1…
CVE-2024-46662, published 2025-03-14. High severity, CVSS 8.8. EPSS: 2.3% chance of exploitation in the next 30 days. A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiManager versions 7.4.1 through 7.4.3, FortiManager Cloud versions 7.4.1 through 7.4.3 allows…
CVE-2024-40584, published 2025-02-11. High severity, CVSS 7.2. EPSS: 2% chance of exploitation in the next 30 days. An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiAnalyzer version 7.4.0 through 7.4.3, 7.2.0 through 7.2.5, 7.0.0…
CVE-2024-48889, published 2024-12-18. High severity, CVSS 7.2. EPSS: 1.7% chance of exploitation in the next 30 days. An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiManager version 7.6.0, version 7.4.4 and below, version 7.2.7 and below,…
CVE-2024-50566, published 2025-01-14. High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days. A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiManager Cloud 7.6.0 through 7.6.1, FortiManager Cloud 7.4.0 through 7.4.4,…
CVE-2026-22828, published 2026-04-14. High severity, CVSS 8.1. EPSS: 0.9% chance of exploitation in the next 30 days. A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiManager Cloud 7.6.2 through 7.6.4 may allow a remote unauthenticated attacker to execute arbitrary…
CVE-2024-35275, published 2025-01-14. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiAnalyzer version 7.4.0 through 7.4.2, FortiManager version 7.4.0 through 7.4.2 allows attacker…
CVE-2024-35277, published 2025-01-14. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. A missing authentication for critical function in Fortinet FortiPortal version 6.0.0 through 6.0.15, FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through…
CVE-2026-106171, published 2026-10-13. Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days. A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.6, FortiManager Cloud 7.6.2…

Latest

CVE-2026-23707, published 2026-10-13. High severity, CVSS 7.2. EPSS: 0.3% chance of exploitation in the next 30 days. An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through…
CVE-2026-22575, published 2026-09-08. Medium severity, CVSS 4.9. EPSS: 0.2% chance of exploitation in the next 30 days. An improper access control vulnerability in Fortinet FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.10, FortiManager 7.2 all versions, FortiManager Cloud 7.6.2 through 7.6.4,…
CVE-2026-70468, published 2026-08-12. High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days. A authentication bypass using an alternate path or channel vulnerability in Fortinet FortiManager 7.6.1, FortiManager 7.4.3 through 7.4.5, FortiManager 7.2.5 through 7.2.9, FortiManager Cloud 7.6.1,…
CVE-2025-68649, published 2026-04-14. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all…
CVE-2025-61848, published 2026-04-14. High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days. An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.8, FortiAnalyzer…
CVE-2026-22629, published 2026-03-10. Low severity, CVSS 3.7. EPSS: 0.4% chance of exploitation in the next 30 days. An improper restriction of excessive authentication attempts vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4 all versions, FortiAnalyzer 7.2 all versions, FortiAnalyzer…
CVE-2026-22572, published 2026-03-10. High severity, CVSS 7.2. EPSS: 0.6% chance of exploitation in the next 30 days. An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.3, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2.2 through 7.2.11,…
CVE-2025-68648, published 2026-03-10. High severity, CVSS 7.2. EPSS: 0.6% chance of exploitation in the next 30 days. A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all…