Fortinet Fortisase vulnerabilities

11 CVEs affecting Fortinet Fortisase, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-106175, published 2026-10-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-25249: Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability, published 2026-01-13. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2026-09-09. EPSS: 3.8% chance of exploitation in the next 30 days. A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions,…
CVE-2024-50562, published 2025-06-10. Medium severity, CVSS 4.8. EPSS: 1.2% chance of exploitation in the next 30 days. An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions may allow an…
CVE-2025-25250, published 2025-06-10. Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days. An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2 all versions, FortiOS 7.0 all…
CVE-2024-47569, published 2025-10-14. Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days. A insertion of sensitive information into sent data vulnerability in Fortinet FortiMail 7.4.0 through 7.4.2, FortiMail 7.2.0 through 7.2.6, FortiMail 7.0 all versions, FortiManager 7.6.0 through…
CVE-2024-47570, published 2025-12-09. Medium severity, CVSS 6.6. EPSS: 0.4% chance of exploitation in the next 30 days. An insertion of sensitive information into log file vulnerability [CWE-532] in FortiOS 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0 all versions; FortiProxy 7.4.0 through 7.4.3, 7.2.0 through…
CVE-2025-31366, published 2025-10-14. Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days. An Improper Neutralization of Input During Web Page Generation vulnerability [CWE-79] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions,…
CVE-2024-55599, published 2025-07-08. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. An Improperly Implemented Security Check for Standard vulnerability [CWE-358] in FortiOS version 7.6.0, version 7.4.7 and below, 7.0 all versions, 6.4 all versions and FortiProxy version 7.6.1 and…
CVE-2025-24471, published 2025-06-10. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. An Improper Certificate Validation vulnerability [CWE-295] in FortiOS version 7.6.1 and below, version 7.4.7 and below may allow an EAP verified remote user to connect from FortiClient via revoked…
CVE-2025-58413, published 2025-11-18. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS…
CVE-2025-47890, published 2025-10-14. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. An URL Redirection to Untrusted Site vulnerabilities [CWE-601] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions,…

Latest

CVE-2026-106175, published 2026-10-13. Low severity, CVSS 2.3. EPSS: 0.1% chance of exploitation in the next 30 days. A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.7, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiProxy 7.6.0 through 7.6.6, FortiProxy 7.4 all…