Filter by Date
- 2022
  - 16 11-2022
  - 9 10-2022
  - 12 09-2022
  - 3 08-2022
  - 11 07-2022
  - 7 06-2022
  - 9 05-2022
  - 15 04-2022
  - 11 03-2022
  - 7 02-2022
- 2021
  - 41 12-2021
  - 21 11-2021
  - 7 10-2021
  - 12 09-2021
  - 21 08-2021
  - 18 07-2021
  - 16 06-2021
  - 3 05-2021
  - 4 04-2021
  - 4 03-2021
  - 4 02-2021
  - 8 01-2021
- 2020
  - 3 12-2020
  - 1 11-2020
  - 4 10-2020
  - 8 09-2020
  - 2 07-2020
  - 11 06-2020
  - 4 05-2020
  - 4 04-2020
  - 10 03-2020
  - 6 02-2020
  - 9 01-2020
- 2019
  - 1 12-2019
  - 11 11-2019
  - 4 10-2019
  - 3 09-2019
  - 5 08-2019
  - 6 07-2019
  - 2 06-2019
  - 4 05-2019
  - 7 04-2019
  - 1 03-2019
  - 1 02-2019
  - 2 01-2019
- 2018
  - 1 12-2018
  - 4 11-2018
  - 8 08-2018
  - 2 07-2018
  - 5 06-2018
  - 5 05-2018
  - 3 04-2018
  - 1 03-2018
  - 2 01-2018
- 2017
  - 3 12-2017
  - 6 11-2017
  - 8 10-2017
  - 1 09-2017
  - 2 08-2017
  - 2 07-2017
  - 2 06-2017
  - 2 05-2017
  - 12 04-2017
  - 2 02-2017
- 2016
  - 1 12-2016
  - 5 11-2016
  - 1 10-2016
  - 6 09-2016
  - 6 08-2016
  - 3 07-2016
  - 1 06-2016
  - 2 05-2016
  - 1 04-2016
  - 2 03-2016
  - 1 02-2016
  - 1 01-2016
- 2015
  - 2 12-2015
  - 2 09-2015
  - 6 07-2015
  - 1 06-2015
  - 2 05-2015
  - 3 04-2015
  - 2 03-2015
  - 5 02-2015
  - 1 01-2015
- 2014
  - 1 12-2014
  - 3 10-2014
  - 1 09-2014
  - 1 08-2014
  - 1 07-2014
  - 1 06-2014
  - 1 05-2014
  - 3 04-2014
  - 3 02-2014
  - 1 01-2014
- 2013
  - 1 12-2013
  - 1 11-2013
  - 1 07-2013
  - 1 06-2013
  - 1 05-2013
  - 1 01-2013
- 2012
  - 2 12-2012
  - 2 10-2012
  - 1 09-2012
  - 1 08-2012
  - 1 05-2012
  - 1 02-2012
Filter by Severity
- 31 Critical
- 119 High
- 278 Medium
- 84 Low
- 11 Informational
Filter by Affected Product
- All
- 87 FortiOS
- 40 FortiManager
- 39 FortiWeb
- 35 FortiAnalyzer
- 27 FortiProxy
- 23 FortiMail
- 19 FortiPortal
- 18 FortiADC
- 18 FortiSandbox
- 16 FortiClientWindows
- 12 FortiWAN
- 11 FortiAuthenticator
- 11 FortiClientEMS
- 11 FortiSIEM
- 11 FortiWLC
- 9 FortiClientMac
- 9 FortiWLM
- 8 FortiNAC
- 8 FortiSwitch
- 7 FortiAP
- 7 FortiDDoS
- 7 FortiSOAR
- 6 FortiRecorder
- 6 FortiTester
- 6 FortiVoiceEnterprise
- 5 FortiAP-S
- 5 FortiAP-U
- 5 FortiAP-W2
- 5 FortiClientLinux
- 5 FortiDeceptor
- 5 FortiEDR
- 4 FortiDDoS-F
- 4 FortiIsolator
- 3 FortiADCManager
- 3 FortiExtender
- 3 FortiNDR
- 3 FortiSIEMWindowsAgent
- 2 AscenLink
- 2 FortiAP-C
- 2 FortiAnalyzer-BigData
- 2 FortiCache
- 2 FortiClientiOS
- 2 FortiDDoS-CM
- 2 FortiTokenAndroid
- 2 FortiWebManager
- 2 Meru AP
- 1 AV Engine
- 1 FSSO Windows CA
- 1 FSSO Windows DC Agent
- 1 FortiClientAndroid
- 1 FortiCloud
- 1 FortiDB
- 1 FortiFone
- 1 FortiGuard
- 1 FortiOS-6K7K
- 1 FortiSDNConnector
- 1 FortiSwitchManager
- 1 FortiTokenIOS
- 1 FortiTokenMobileWP
- 1 FortiWAN-Manager
- 1 Meru Controller

Refine Search

PSIRT Advisories

Monthly PSIRT Advisories

2022: Nov , Sep , Aug , Jul , Jun , May , Apr , Mar , Feb
2021: Dec , Nov , Oct , Sep , Aug , Jul , Jun , May , Apr , Mar , Feb , Jan
2020: Dec

The following is a list of advisories for issues resolved in Fortinet products. The resolution of such issues is coordinated by the Fortinet Product Security Incident Response Team (PSIRT), a dedicated, global team that manages the receipt, investigation, and public reporting of information about security vulnerabilities and issues related to Fortinet products and services.

For details of how to raise a PSIRT Issue with Fortinet, please see our PSIRT Policy here.

FortiClient (Windows) - Denial of service due to folder access permission change

An improper control of a resource through its lifetime [CWE-664] vulnerability in FortiClient (Windows) may allow a privil...

FortiClientWindows 6.4.1, 6.4.0, 6.2.9, 6.2.8, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.10, 6.0.1, 6.0.0, 5.6.6, 5.6.5, 5.6.4, 5.6.3, 5.6.2, 5.6.1, 5.6.0, 5.4.5, 5.4.4, 5.4.3, 5.4.2, 5.4.1, 5.4.0, 5.2.6, 5.2.5, 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, 5.0.9, 5.0.8, 5.0.7, 5.0.6, 5.0.5, 5.0.4, 5.0.3, 5.0.2, 5.0.11, 5.0.10, 5.0.1, 5.0.0, 4.3.5, 4.3.4, 4.3.3, 4.3.2, 4.3.1, 4.3.0, 4.2.7, 4.2.6, 4.2.5, 4.2.4, 4.2.3, 4.2.2, 4.2.1, 4.2.0, 4.1.3, 4.1.2, 4.1.1, 4.1.0, 4.0.4, 4.0.3, 4.0.2, 4.0.1

Dec 07, 2021 Severity light-circle-logo

Medium IR Number: FG-IR-21-167 CVE-2021-43204

FortiClient (Windows) - Web filter bypass

An improper authorization vulnerabiltiy [CWE-285] in FortiClient Windows may allow an unauthenticated attacker to bypass t...

FortiClientWindows 7.0.0, 6.4.6, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.8, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0

Dec 07, 2021 Severity light-circle-logo

Medium IR Number: FG-IR-20-127 CVE-2021-36167

FortiClient EMS - SAML SSO replay attack

An authentication bypass by capture-replay vulnerability [CWE-294] in FortiClient EMS may allow an unauthenticated attacke...

FortiClientEMS 7.0.1, 7.0.0, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.9, 6.2.8, 6.2.7, 6.2.6, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0

Dec 07, 2021 Severity light-circle-logo

Medium IR Number: FG-IR-21-192 CVE-2021-41030

FortiClientEMS & FortiClient - Telemetry protocol is vulnerable to a MitM Vulnerability

A combination of a use of hard-coded cryptographic key vulnerability [CWE-321] in FortiClientEMS and an improper certifica...

FortiClientMac 7.0.1, 7.0.0, 6.4.6, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.9, 6.2.8, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.10, 6.0.1 FortiClientEMS 7.0.1, 7.0.0, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.9, 6.2.8, 6.2.7, 6.2.6, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0 FortiClientWindows 7.0.1, 7.0.0, 6.4.6, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.9, 6.2.8, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.10, 6.0.1, 6.0.0 FortiClientLinux 7.0.1, 7.0.0, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.9, 6.2.8, 6.2.7, 6.2.6, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0

Dec 07, 2021 Severity light-circle-logo

High IR Number: FG-IR-21-075 CVE-2021-41028

FortiClientEMS - Sensitive information leak

A missing encryption of sensitive data vulnerability [CWE-311] in FortiClientEMS may allow an authenticated attacker to vi...

FortiClientEMS 7.0.1, 7.0.0, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0

Dec 07, 2021 Severity light-circle-logo

Medium IR Number: FG-IR-21-140 CVE-2021-36189

FortiNAC - Privilege Escalation via exploiting the SUDO privileges.

A privilege escalation vulnerability in FortiNAC may allow an admin user to escalate the privileges to root via the sudo command.

FortiNAC 9.1.2, 9.1.1, 9.1.0, 8.8.8, 8.8.7, 8.8.6, 8.8.5, 8.8.4, 8.8.3, 8.8.2, 8.8.1, 8.8.0

Dec 07, 2021 Severity light-circle-logo

High IR Number: FG-IR-21-182 CVE-2021-41021

FortiNAC - improper permissions set for tomcat users configuration file

An incorrect permission assignment for a critical resource vulnerability [CWE-732] in FortiNAC may allow an authenticated ...

FortiNAC 9.2.0, 9.1.3, 9.1.2, 9.1.1, 9.1.0, 8.8.9, 8.8.8, 8.8.7, 8.8.6, 8.8.5, 8.8.4, 8.8.3, 8.8.2, 8.8.1, 8.8.0

Dec 07, 2021 Severity light-circle-logo

High IR Number: FG-IR-21-178 CVE-2021-43065

FortiOS & FortiProxy - SSL-VPN portal is vulnerable to CSRF

An insufficient verification of data authenticity vulnerability (CWE-345) in the user interface of FortiProxy and FortiGat...

FortiProxy 2.0.3, 2.0.2, 2.0.1, 2.0.0, 1.2.9, 1.2.8, 1.2.7, 1.2.6, 1.2.5, 1.2.4, 1.2.3, 1.2.2, 1.2.11, 1.2.10, 1.2.1, 1.2.0 FortiOS 7.0.0, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.9, 6.2.8, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.14, 6.0.13, 6.0.12, 6.0.11, 6.0.10, 6.0.1, 6.0.0, 5.6.9, 5.6.8, 5.6.7, 5.6.6, 5.6.5, 5.6.4, 5.6.3, 5.6.2, 5.6.14, 5.6.13, 5.6.12, 5.6.11, 5.6.10, 5.6.1, 5.6.0

Dec 07, 2021 Severity light-circle-logo

Medium IR Number: FG-IR-20-158 CVE-2021-26103

FortiOS & FortiProxy -- Path traversal vulnerability

A relative path traversal [CWE-23] vulnerabiltiy in FortiOS and FortiProxy may allow an unauthenticated, unauthorized atta...

FortiOS 7.0.1, 7.0.0 FortiProxy 7.0.0

Dec 07, 2021 Severity light-circle-logo

High IR Number: FG-IR-21-181 CVE-2021-41024

FortiOS - Hardcoded SSLVPN cookie encryption key

A use of hard-coded cryptographic key vulnerability [CWE 321] in FortiOS SSLVPN may allow an attacker to retrieve the key ...

FortiOS 7.0.0, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.8, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.12, 6.0.11, 6.0.10, 6.0.1, 6.0.0, 5.6.9, 5.6.8, 5.6.7, 5.6.6, 5.6.5, 5.6.4, 5.6.3, 5.6.2, 5.6.13, 5.6.12, 5.6.11, 5.6.10, 5.6.1, 5.6.0

Dec 07, 2021 Severity light-circle-logo

High IR Number: FG-IR-21-051 CVE-2021-26108

FortiOS - Heap-based Buffer Overflow in firmware signature verification

A heap-based buffer overflow [CWE-122] in the firmware signature verification function of FortiOS may allow an attacker to...

FortiOS 7.0.1, 7.0.0, 6.4.6, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.9, 6.2.8, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.13, 6.0.12, 6.0.11, 6.0.10, 6.0.1, 6.0.0

Dec 07, 2021 Severity light-circle-logo

High IR Number: FG-IR-21-115 CVE-2021-36173

FortiOS - Integer overflow in SSLVPN allocator

An integer overflow or wraparound vulnerability [CWE-190] in FortiOS SSLVPN memory allocator may allow an unauthenticated ...

FortiOS 7.0.0, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.8, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.12, 6.0.11, 6.0.10, 6.0.1, 6.0.0

Dec 07, 2021 Severity light-circle-logo

High IR Number: FG-IR-21-049 CVE-2021-26109

FortiOS - Removal of `restore src-vis` command.

A download of code without integrity check vulnerability [CWE-494] in the "execute restore src-vis" command of FortiOS may...

FortiOS 7.0.2, 7.0.1, 7.0.0, 6.4.7, 6.4.6, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.9, 6.2.8, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.13, 6.0.12, 6.0.11, 6.0.10, 6.0.1, 6.0.0, 5.6.9, 5.6.8, 5.6.7, 5.6.6, 5.6.5, 5.6.4, 5.6.3, 5.6.2, 5.6.14, 5.6.13, 5.6.12, 5.6.11, 5.6.10, 5.6.1, 5.6.0, 5.4.9, 5.4.8, 5.4.7, 5.4.6, 5.4.5, 5.4.4, 5.4.3, 5.4.2, 5.4.13, 5.4.12, 5.4.11, 5.4.10, 5.4.1, 5.4.0, 5.2.9, 5.2.8, 5.2.7, 5.2.6, 5.2.5, 5.2.4, 5.2.3, 5.2.2, 5.2.15, 5.2.14, 5.2.13, 5.2.12, 5.2.11, 5.2.10, 5.2.1, 5.2.0, 5.0.9, 5.0.8, 5.0.7, 5.0.6, 5.0.5, 5.0.4, 5.0.3, 5.0.2, 5.0.14, 5.0.13, 5.0.12, 5.0.11, 5.0.10, 5.0.1, 5.0.0

Dec 07, 2021 Severity light-circle-logo

Low IR Number: FG-IR-21-201 CVE-2021-44168

FortiOS and FortiProxy - Privilege escalation vulnerability using the automation script feature

An improper access control vulnerability [CWE-284] in FortiOS and FortiProxy autod daemon may allow an authenticated low-p...

FortiOS 7.0.0, 6.4.6, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.9, 6.2.8, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.12, 6.0.11, 6.0.10, 6.0.1, 6.0.0, 5.6.9, 5.6.8, 5.6.7, 5.6.6, 5.6.5, 5.6.4, 5.6.3, 5.6.2, 5.6.14, 5.6.13, 5.6.12, 5.6.11, 5.6.10, 5.6.1, 5.6.0

Dec 07, 2021 Severity light-circle-logo

High IR Number: FG-IR-20-131 CVE-2021-26110

FortiSandbox, FortiWeb, FortiADC, FortiMail - Multiple cryptographic flaws allow for full LDAP and RADIUS passwords compromise

A missing cryptographic steps vulnerability [CWE-325] in the function that encrypts users' LDAP and RADIUS credentials in ...

FortiADC 6.2.0, 6.1.3, 6.1.2, 6.1.1, 6.1.0, 6.0.3, 6.0.2, 6.0.1, 6.0.0 FortiSandbox 3.2.2, 3.2.1, 3.2.0 FortiWeb 6.3.9, 6.3.8, 6.3.7, 6.3.6, 6.3.5, 6.3.4, 6.3.3, 6.3.2, 6.3.11, 6.3.10, 6.3.1, 6.3.0, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0

Dec 07, 2021 Severity light-circle-logo

Medium IR Number: FG-IR-20-222 CVE-2021-32591

1
2
...
5
6
7
8
9
10
11
...
34
35

1
...
7
8
9
...
35