Fortinet Fortinac vulnerabilities

30 CVEs affecting Fortinet Fortinac, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-33300, published 2025-03-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-39952, published 2023-02-16. Critical severity, CVSS 9.8. EPSS: 99.8% chance of exploitation in the next 30 days. A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through…
CVE-2023-33299, published 2023-06-23. Critical severity, CVSS 9.8. EPSS: 24.3% chance of exploitation in the next 30 days. A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier versions of 8.x allows attacker to execute unauthorized code or commands via…
CVE-2023-33300, published 2025-03-14. Medium severity, CVSS 5.3. EPSS: 13.7% chance of exploitation in the next 30 days. A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiNAC 7.2.1 and earlier, 9.4.3 and earlier allows attacker a limited, unauthorized file access via…
CVE-2020-12816, published 2020-09-24. Medium severity, CVSS 6.1. EPSS: 1.2% chance of exploitation in the next 30 days. An improper neutralization of input vulnerability in FortiNAC before 8.7.2 may allow a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the UserID of Admin…
CVE-2022-38375, published 2023-02-16. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. An improper authorization vulnerability [CWE-285] in Fortinet FortiNAC version 9.4.0 through 9.4.1 and before 9.2.6 allows an unauthenticated user to perform some administrative operations over the…
CVE-2024-31488, published 2024-05-14. Critical severity, CVSS 9.0. EPSS: 1% chance of exploitation in the next 30 days. An improper neutralization of inputs during web page generation vulnerability [CWE-79] in FortiNAC version 9.4.0 through 9.4.4, 9.2.0 through 9.2.8, 9.1.0 through 9.1.10, 8.8.0 through 8.8.11, 8.7.0…
CVE-2022-26117, published 2022-07-18. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. An empty password in configuration file vulnerability [CWE-258] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and…
CVE-2022-26116, published 2022-05-11. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. Multiple improper neutralization of special elements used in SQL commands ('SQL Injection') vulnerability [CWE-89] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below,…
CVE-2021-24011, published 2021-05-10. High severity, CVSS 7.2. EPSS: 0.8% chance of exploitation in the next 30 days. A privilege escalation vulnerability in FortiNAC version below 8.8.2 may allow an admin user to escalate the privileges to root by abusing the sudo privileges.
CVE-2022-40677, published 2023-02-16. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. A improper neutralization of argument delimiters in a command ('argument injection') in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through…

Latest

CVE-2023-26206, published 2024-02-15. Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days. An improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiNAC 9.4.0 - 9.4.2, 9.2.0 - 9.2.8, 9.1.0 - 9.1.10 and 7.2.0 allows an attacker to execute…
CVE-2023-22633, published 2023-06-13. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. An improper permissions, privileges, and access controls vulnerability [CWE-264] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.0 all versions 8.7.0 all versions…
CVE-2022-39946, published 2023-06-13. High severity, CVSS 7.2. EPSS: 0.7% chance of exploitation in the next 30 days. An access control vulnerability [CWE-284] in FortiNAC version 9.4.2 and below, version 9.2.7 and below, 9.1 all versions, 8.8 all versions, 8.7 all versions, 8.6 all versions, 8.5 all versions may…
CVE-2023-26203, published 2023-05-03. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A use of hard-coded credentials vulnerability [CWE-798] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions may allow…
CVE-2023-22637, published 2023-05-03. Critical severity, CVSS 9.0. EPSS: 0.6% chance of exploitation in the next 30 days. An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all…
CVE-2022-45860, published 2023-05-03. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. A weak authentication vulnerability [CWE-1390] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions in device…
CVE-2022-45859, published 2023-05-03. Medium severity, CVSS 4.4. EPSS: 0.1% chance of exploitation in the next 30 days. An insufficiently protected credentials vulnerability [CWE-522] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.0 all versions, 8.7.0 all versions may allow a…