CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Fortinet FortiOS and Multi-Product FortiCloud SSO Authentication Bypass Vulnerability (CVE-2026-24858) Critical Security Advisory
[Affected Scope] FortiOS, FortiManager, FortiAnalyzer, FortiProxy, FortiWeb, and FortiNAC-F devices with FortiCloud SSO authentication enabled
[Impact] An attacker with a valid FortiCloud account and a registered device can bypass authentication to log into other registered devices under different accounts, gaining full administrative control (CVSS 9.8, Active KEV)
[Mitigation] Immediately upgrade to the patched firmware versions or disable FortiCloud SSO administrator login on all affected devices
Fortinet FortiWeb OS Command Injection and Remote Code Execution Vulnerability (CVE-2025-58034) Security Advisory
[Affected Scope] Fortinet FortiWeb versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.5, 7.4.0 through 7.4.10, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.11
[Impact] An authenticated attacker can execute arbitrary OS commands with elevated privileges on the underlying system via crafted HTTP requests or CLI commands
[Mitigation] Immediately upgrade to the patched versions (8.0.2, 7.6.6, 7.4.11, 7.2.12, 7.0.12 or higher) as recommended by the vendor
Fortinet FortiWeb Relative Path Traversal Remote Code Execution Vulnerability Urgent Security Advisory (CVE-2025-64446)
[Affected Scope] Fortinet FortiWeb versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.11
[Impact] Unauthenticated remote attackers can execute arbitrary administrative commands on the system via crafted HTTP or HTTPS requests
[Mitigation] Immediately upgrade to the official patched versions (8.0.2, 7.6.5, 7.4.10, 7.2.12, 7.0.12 or higher)
Fortinet FortiWeb SQL Injection Vulnerability (CVE-2025-25257) Critical Security Advisory and Mitigation Guide
[Affected Scope] Fortinet FortiWeb versions 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, 7.2.0 through 7.2.10, and 7.0.0 through 7.0.10
[Impact] An unauthenticated remote attacker can execute unauthorized SQL commands via crafted HTTP/HTTPS requests, potentially leading to sensitive data exposure, system compromise, and remote code execution (RCE).
[Mitigation] Immediately upgrade to the patched versions (7.6.4, 7.4.8, 7.2.11, 7.0.11 or higher) and restrict access to the management interface.