Fortinet Fortiswitch vulnerabilities

15 CVEs affecting Fortinet Fortiswitch, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-106175, published 2026-10-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-6909, published 2016-08-24. Critical severity, CVSS 9.8. EPSS: 49.9% chance of exploitation in the next 30 days. Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9 and FortiSwitch before 3.4.3 allows remote attackers to execute arbitrary code…
CVE-2023-25610, published 2025-03-24. Critical severity, CVSS 9.8. EPSS: 18.3% chance of exploitation in the next 30 days. A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.6, version 6.4.0 through 6.4.11 and…
CVE-2024-48887, published 2025-04-08. Critical severity, CVSS 9.8. EPSS: 15.7% chance of exploitation in the next 30 days. A unverified password change vulnerability in Fortinet FortiSwitch GUI may allow a remote unauthenticated attacker to change admin passwords via a specially crafted request
CVE-2016-4573, published 2016-09-09. Critical severity, CVSS 9.8. EPSS: 4.6% chance of exploitation in the next 30 days. Fortinet FortiSwitch FSW-108D-POE, FSW-124D, FSW-124D-POE, FSW-224D-POE, FSW-224D-FPOE, FSW-248D-POE, FSW-248D-FPOE, FSW-424D, FSW-424D-POE, FSW-424D-FPOE, FSW-448D, FSW-448D-POE, FSW-448D-FPOE,…
CVE-2019-17657, published 2020-04-07. High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days. An Uncontrolled Resource Consumption vulnerability in Fortinet FortiSwitch below 3.6.11, 6.0.6 and 6.2.2, FortiAnalyzer below 6.2.3, FortiManager below 6.2.3 and FortiAP-S/W2 below 6.2.2 may allow an…
CVE-2023-37936, published 2025-01-14. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. A use of hard-coded cryptographic key in Fortinet FortiSwitch version 7.4.0 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.7 and 6.4.0 through 6.4.13 and 6.2.0 through 6.2.7 and 6.0.0 through 6.0.7…
CVE-2023-37937, published 2025-01-14. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSwitch version 7.4.0 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.7 and 6.4.0 through…
CVE-2021-42757, published 2021-12-08. Medium severity, CVSS 6.7. EPSS: 0.5% chance of exploitation in the next 30 days. A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to achieve arbitrary code execution via…
CVE-2022-27488, published 2023-12-13. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. A cross-site request forgery (CSRF) in Fortinet FortiVoiceEnterprise version 6.4.x, 6.0.x, FortiSwitch version 7.0.0 through 7.0.4, 6.4.0 through 6.4.10, 6.2.0 through 6.2.7, 6.0.x, FortiMail version…
CVE-2022-27490, published 2023-03-07. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. A exposure of sensitive information to an unauthorized actor in Fortinet FortiManager version 6.0.0 through 6.0.4, FortiAnalyzer version 6.0.0 through 6.0.4, FortiPortal version 6.0.0 through 6.0.9,…

Latest

CVE-2026-106175, published 2026-10-13. Low severity, CVSS 2.3. EPSS: 0.1% chance of exploitation in the next 30 days. A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.7, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiProxy 7.6.0 through 7.6.6, FortiProxy 7.4 all…
CVE-2022-23439, published 2025-01-22. Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days. A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafted HTTP requests, where the `Host` header points to an…
CVE-2021-43074, published 2023-02-16. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. An improper verification of cryptographic signature vulnerability [CWE-347] in FortiWeb 6.4 all versions, 6.3.16 and below, 6.2 all versions, 6.1 all versions, 6.0 all versions; FortiOS 7.0.3 and…
CVE-2021-42755, published 2022-07-18. Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days. An integer overflow / wraparound vulnerability [CWE-190] in FortiSwitch 7.0.2 and below, 6.4.9 and below, 6.2.x, 6.0.x; FortiRecorder 6.4.2 and below, 6.0.10 and below; FortiOS 7.0.2 and below, 6.4.8…