Fortinet Fortinac-F vulnerabilities

13 CVEs affecting Fortinet Fortinac-F, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-21741, published 2026-04-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-24858: Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability, published 2026-01-27. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2026-01-27. EPSS: 85.8% chance of exploitation in the next 30 days. An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0…
CVE-2022-38375, published 2023-02-16. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. An improper authorization vulnerability [CWE-285] in Fortinet FortiNAC version 9.4.0 through 9.4.1 and before 9.2.6 allows an unauthenticated user to perform some administrative operations over the…
CVE-2023-22633, published 2023-06-13. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. An improper permissions, privileges, and access controls vulnerability [CWE-264] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.0 all versions 8.7.0 all versions…
CVE-2023-22637, published 2023-05-03. Critical severity, CVSS 9.0. EPSS: 0.6% chance of exploitation in the next 30 days. An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all…
CVE-2022-43951, published 2023-04-11. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.11 and below, 8.7.6 and below may allow an…
CVE-2022-39954, published 2023-02-16. Critical severity, CVSS 9.1. EPSS: 0.5% chance of exploitation in the next 30 days. An improper restriction of xml external entity reference in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.2.7, FortiNAC version 9.1.0 through 9.1.8, FortiNAC version…
CVE-2022-45860, published 2023-05-03. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. A weak authentication vulnerability [CWE-1390] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions in device…
CVE-2022-43950, published 2023-05-03. Medium severity, CVSS 4.7. EPSS: 0.4% chance of exploitation in the next 30 days. A URL redirection to untrusted site ('Open Redirect') vulnerability [CWE-601] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.1 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions,…
CVE-2022-40675, published 2023-02-16. High severity, CVSS 7.4. EPSS: 0.4% chance of exploitation in the next 30 days. Some cryptographic issues in Fortinet FortiNAC versions 9.4.0 through 9.4.1, 9.2.0 through 9.2.7, 9.1.0 through 9.1.8, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through…
CVE-2026-21741, published 2026-04-14. Medium severity, CVSS 4.8. EPSS: 0.2% chance of exploitation in the next 30 days. An URL Redirection to Untrusted Site ('Open Redirect') vulnerability [CWE-601] vulnerability in Fortinet FortiNAC-F 7.6.0 through 7.6.5, FortiNAC-F 7.4 all versions, FortiNAC-F 7.2 all versions may…

Latest

CVE-2023-48785, published 2025-03-14. Medium severity, CVSS 4.8. EPSS: 0.2% chance of exploitation in the next 30 days. An improper certificate validation vulnerability [CWE-295] in FortiNAC-F version 7.2.4 and below may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the HTTPS…
CVE-2023-26203, published 2023-05-03. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A use of hard-coded credentials vulnerability [CWE-798] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions may allow…
CVE-2022-45859, published 2023-05-03. Medium severity, CVSS 4.4. EPSS: 0.1% chance of exploitation in the next 30 days. An insufficiently protected credentials vulnerability [CWE-522] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.0 all versions, 8.7.0 all versions may allow a…