Vendor scorecard
Fortinet
FortiGate firewalls and the wider Fortinet security fabric.
CPE: fortinet
Product families
10
Open in latest
294
Inferred — see methodology
Last disclosure
Aug 12, 2026
01
Product categories
10 trackedCVE volume, severity mix and the inferred latest shipping version per category.
| Category | CVEs | Volume | Severity mix | Open | Inferred latest |
|---|---|---|---|---|---|
| FortiOS/FortiGateNGFW / Network Security · SD-WAN & SASE · Secure Remote Access / VPN · Network Detection / IDS-IPSfortios, fortigate | 277 | 93 | 7.6.7HIGH | ||
| FortiManager/FortiAnalyzerNetwork Management & Monitoringfortimanager, fortianalyzer | 128 | 33 | 7.6.6HIGH | ||
| FortiWebNGFW / Network Securityfortiweb | 126 | 46 | 8.0.4HIGH | ||
| FortiProxyNGFW / Network Securityfortiproxy | 125 | 38 | 7.6.6HIGH | ||
| FortiClientSecure Remote Access / VPN · Zero-Trust / ZTNAforticlient, forticlient_endpoint_management_server | 91 | 28 | 7.2.4HIGH | ||
| FortiSIEM/FortiSOARNetwork Detection / IDS-IPS · Network Management & Monitoringfortisiem, fortisoar | 63 | 28 | 7.6.5HIGH | ||
| FortiADCApplication Delivery / ADCfortiadc | 43 | 26 | 7.6.4HIGH | ||
| FortiNACNGFW / Network Securityfortinac | 30 | 15 | 9.4.5HIGH | ||
| FortiSwitchRouting & Switchingfortiswitch | 14 | 4 | 7.4.5HIGH | ||
| FortiAPWireless LANfortiap, fortiap-s | 9 | 2 | 6.4.10HIGH |
Each count is distinct CVEs within that category. A CVE affecting more than one category is counted in each, so these can sum to more than the Fortinet total above.
02
Disclosure trend
12 monthsCumulative CVEs published on or before each month-end over the last 12 months, stacked by CVSS severity. A fixed 12-month window — independent of the date filter above.
- Critical
- High
- Medium
- Low
03
Recent CVEs
12 shownMost recently published, newest first. Each ID links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2026-71408(opens NVD record) | Medium | 5.3 | A allocation of resources without limits or throttling vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4 all versions, FortiOS 7.2 all versions may allow attacker to denial of service via <insert attack vector here> | Aug 12, 2026 |
| CVE-2026-71407(opens NVD record) | Medium | 5.6 | A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6 may allow an unauthenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands in the context of the WAD daemon via crafted sockets, only if the explicit proxy is configured with Kerberos authentication and SOCKS enabled. | Aug 12, 2026 |
| CVE-2026-70468(opens NVD record) | High | 8.1 | A authentication bypass using an alternate path or channel vulnerability in Fortinet FortiManager 7.6.1, FortiManager 7.4.3 through 7.4.5, FortiManager 7.2.5 through 7.2.9, FortiManager Cloud 7.6.1, FortiManager Cloud 7.4.3 through 7.4.5, FortiManager Cloud 7.2.5 through 7.2.9 may allow attacker to improper access control via <insert attack vector here> | Aug 12, 2026 |
| CVE-2026-70467(opens NVD record) | Low | 3.8 | A server-side request forgery (ssrf) vulnerability in Fortinet FortiSIEM 7.5.0, FortiSIEM 7.4.0 through 7.4.2, FortiSIEM 7.3.0 through 7.3.5, FortiSIEM 7.2 all versions, FortiSIEM 7.1 all versions, FortiSIEM 7.0 all versions, FortiSIEM 6.7 all versions, FortiSIEM 6.6 all versions, FortiSIEM 6.5 all versions may allow attacker to execute unauthorized code or commands via <insert attack vector here> | Aug 12, 2026 |
| CVE-2026-70466(opens NVD record) | Medium | 5.3 | A incomplete list of disallowed inputs vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow attacker to improper access control via <insert attack vector here> | Aug 12, 2026 |
| CVE-2026-26035(opens NVD record) | Critical | 9.8 | An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11, FortiWeb 7.2.0 through 7.2.12, FortiWeb 7.0.0 through 7.0.12 may allow a remote unauthenticated attacker to login into the Fortiweb GUI/CLI with a random username and password | Aug 12, 2026 |
| CVE-2026-70465(opens NVD record) | High | 8.1 | A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through 7.2.11 may allow an unauthenticated attacker in a position to alter or craft DNS responses to the targeted host to execute arbitrary code via malicious packets. | Aug 12, 2026 |
| CVE-2026-59838(opens NVD record) | Medium | 5.9 | A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.2.0 through 7.2.6, FortiSIEM 7.1 all versions, FortiSIEM 7.0 all versions, FortiSIEM 6.7 all versions, FortiSIEM 6.6 all versions, FortiSIEM 6.5 all versions, FortiSIEM 6.4 all versions may allow attacker to execute unauthorized code or commands via <insert attack vector here> | Jul 15, 2026 |
| CVE-2026-59841(opens NVD record) | High | 7.5 | A improper restriction of communication channel to intended endpoints vulnerability in Fortinet FortiSIEMWindowsAgent 7.4.0 through 7.4.1 may allow attacker to escalation of privilege via <insert attack vector here> | Jul 14, 2026 |
| CVE-2026-59840(opens NVD record) | Medium | 4.3 | A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.5, FortiProxy 7.4.0 through 7.4.13, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions may allow attacker to information disclosure via <insert attack vector here> | Jul 14, 2026 |
| CVE-2026-59839(opens NVD record) | Medium | 5.5 | A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.8.0, FortiPAM 1.7.0 through 1.7.2, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.5, FortiProxy 7.4 through 7.4.13, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions may allow attacker to execute unauthorized code or commands via <insert attack vector here> | Jul 14, 2026 |
| CVE-2026-59837(opens NVD record) | Medium | 6.6 | A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2 all versions, FortiPAM 1.8.0 through 1.8.2, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.4.0 through 7.4.13, FortiProxy 7.2 all versions may allow a privileged authenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands via crafted HTTP requests. | Jul 14, 2026 |
742 CVEs · 10 product families