CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Fortinet FortiOS and Multi-Product FortiCloud SSO Authentication Bypass Vulnerability (CVE-2026-24858) Critical Security Advisory
[Affected Scope] FortiOS, FortiManager, FortiAnalyzer, FortiProxy, FortiWeb, and FortiNAC-F devices with FortiCloud SSO authentication enabled
[Impact] An attacker with a valid FortiCloud account and a registered device can bypass authentication to log into other registered devices under different accounts, gaining full administrative control (CVSS 9.8, Active KEV)
[Mitigation] Immediately upgrade to the patched firmware versions or disable FortiCloud SSO administrator login on all affected devices
Fortinet FortiWeb Relative Path Traversal Remote Code Execution Vulnerability Urgent Security Advisory (CVE-2025-64446)
[Affected Scope] Fortinet FortiWeb versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.11
[Impact] Unauthenticated remote attackers can execute arbitrary administrative commands on the system via crafted HTTP or HTTPS requests
[Mitigation] Immediately upgrade to the official patched versions (8.0.2, 7.6.5, 7.4.10, 7.2.12, 7.0.12 or higher)
Fortinet FortiWeb SQL Injection Vulnerability (CVE-2025-25257) Critical Security Advisory and Mitigation Guide
[Affected Scope] Fortinet FortiWeb versions 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, 7.2.0 through 7.2.10, and 7.0.0 through 7.0.10
[Impact] An unauthenticated remote attacker can execute unauthorized SQL commands via crafted HTTP/HTTPS requests, potentially leading to sensitive data exposure, system compromise, and remote code execution (RCE).
[Mitigation] Immediately upgrade to the patched versions (7.6.4, 7.4.8, 7.2.11, 7.0.11 or higher) and restrict access to the management interface.