Fortinet Fortindr vulnerabilities

11 CVEs affecting Fortinet Fortindr, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-25088, published 2026-05-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-32756: Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability, published 2025-05-13. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2025-05-14. EPSS: 30.7% chance of exploitation in the next 30 days. A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions, FortiCamera 1.1 all versions, FortiMail 7.6.0 through…
CVE-2021-42757, published 2021-12-08. Medium severity, CVSS 6.7. EPSS: 0.5% chance of exploitation in the next 30 days. A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to achieve arbitrary code execution via…
CVE-2022-27488, published 2023-12-13. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. A cross-site request forgery (CSRF) in Fortinet FortiVoiceEnterprise version 6.4.x, 6.0.x, FortiSwitch version 7.0.0 through 7.0.4, 6.4.0 through 6.4.10, 6.2.0 through 6.2.7, 6.0.x, FortiMail version…
CVE-2024-47569, published 2025-10-14. Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days. A insertion of sensitive information into sent data vulnerability in Fortinet FortiMail 7.4.0 through 7.4.2, FortiMail 7.2.0 through 7.2.6, FortiMail 7.0 all versions, FortiManager 7.6.0 through…
CVE-2022-23439, published 2025-01-22. Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days. A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafted HTTP requests, where the `Host` header points to an…
CVE-2023-33302, published 2025-03-31. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. A buffer copy without checking size of input ('classic buffer overflow') in Fortinet FortiMail webmail and administrative interface version 6.4.0 through 6.4.4 and before 6.2.6 and FortiNDR…
CVE-2026-25088, published 2026-05-12. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiNDR 7.6.0 through 7.6.2, FortiNDR 7.4.0 through 7.4.9, FortiNDR 7.2 all…
CVE-2024-23104, published 2026-04-14. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.8, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions, FortiNDR…
CVE-2023-48790, published 2025-03-11. High severity, CVSS 8.8. EPSS: 0.2% chance of exploitation in the next 30 days. A cross site request forgery vulnerability [CWE-352] in Fortinet FortiNDR version 7.4.0, 7.2.0 through 7.2.1 and 7.1.0 through 7.1.1 and before 7.0.5 may allow a remote unauthenticated attacker to…
CVE-2024-47573, published 2025-03-14. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. An improper validation of integrity check value vulnerability [CWE-354] in FortiNDR version 7.4.2 and below, version 7.2.1 and below, version 7.1.1 and below, version 7.0.6 and below may allow an…

Latest

CVE-2024-40588, published 2025-08-12. Medium severity, CVSS 4.4. EPSS: 0.2% chance of exploitation in the next 30 days. Multiple relative path traversal vulnerabilities [CWE-23] vulnerability in Fortinet FortiCamera 2.1 all versions, FortiCamera 2.0.0, FortiCamera 1.1 all versions, FortiCamera 1.0 all versions,…