Exploited CVEs / By vendor / Fortinet
Fortinet vulnerabilities actively exploited
29 Fortinet CVEs on the CISA Known Exploited Vulnerabilities catalog, newest first. Refreshed daily.
Every CVE below is confirmed exploited in the wild, not just theoretically severe. The newest addition is CVE-2025-68686 (FortiOS, added 2026-07-27). 14 of the 29 are used in ransomware campaigns. New CISA KEV entries appear here the day they are cataloged; the freshest across all vendors are on exploited this week.
Senserva AI Opinion and rich prompt for Fortinet exploited CVEs
Copy this prompt into Claude, ChatGPT, or Copilot. The facts are included, sourced from this page.
FortiOS: 9 exploited CVEs
| CVE | Product | Added to KEV | Signals |
|---|---|---|---|
| CVE-2025-68686 | FortiOS | 2026-07-27 | CVSS 5.9, EPSS 1% |
| CVE-2019-6693 | FortiOS | 2025-06-25 | ransomware, CVSS 6.5, EPSS 6% |
| CVE-2024-21762 | FortiOS | 2024-02-09 | ransomware, CVSS 9.8, EPSS 84% |
| CVE-2022-41328 | FortiOS | 2023-03-14 | CVSS 7.1, EPSS 12% |
| CVE-2022-42475 | FortiOS | 2022-12-13 | ransomware, CVSS 9.8, EPSS 99% |
| CVE-2021-44168 | FortiOS | 2021-12-10 | CVSS 7.8, EPSS 1% |
| CVE-2018-13379 | FortiOS | 2021-11-03 | ransomware, CVSS 9.8, EPSS 100% |
| CVE-2019-5591 | FortiOS | 2021-11-03 | ransomware, CVSS 6.5, EPSS 18% |
| CVE-2020-12812 | FortiOS | 2021-11-03 | ransomware, CVSS 9.8, EPSS 49% |
Multiple Products: 5 exploited CVEs
| CVE | Product | Added to KEV | Signals |
|---|---|---|---|
| CVE-2026-24858 | Multiple Products | 2026-01-27 | CVSS 9.8, EPSS 86% |
| CVE-2025-59718 | Multiple Products | 2025-12-16 | CVSS 9.8, EPSS 63% |
| CVE-2025-32756 | Multiple Products | 2025-05-14 | CVSS 9.8, EPSS 30% |
| CVE-2024-23113 | Multiple Products | 2024-10-09 | CVSS 9.8, EPSS 62% |
| CVE-2022-40684 | Multiple Products | 2022-10-11 | ransomware, CVSS 9.8, EPSS 100% |
FortiOS and FortiProxy: 4 exploited CVEs
| CVE | Product | Added to KEV | Signals |
|---|---|---|---|
| CVE-2025-24472 | FortiOS and FortiProxy | 2025-03-18 | ransomware, CVSS 8.1, EPSS 4% |
| CVE-2024-55591 | FortiOS and FortiProxy | 2025-01-14 | ransomware, CVSS 9.8, EPSS 98% |
| CVE-2018-13382 | FortiOS and FortiProxy | 2022-01-10 | ransomware, CVSS 7.5, EPSS 82% |
| CVE-2018-13383 | FortiOS and FortiProxy | 2022-01-10 | ransomware, CVSS 6.5, EPSS 34% |
FortiClient EMS: 3 exploited CVEs
| CVE | Product | Added to KEV | Signals |
|---|---|---|---|
| CVE-2026-21643 | FortiClient EMS | 2026-04-13 | CVSS 9.8, EPSS 94% |
| CVE-2026-35616 | FortiClient EMS | 2026-04-06 | CVSS 9.8, EPSS 89% |
| CVE-2023-48788 | FortiClient EMS | 2024-03-25 | ransomware, CVSS 9.8, EPSS 98% |
FortiWeb: 3 exploited CVEs
| CVE | Product | Added to KEV | Signals |
|---|---|---|---|
| CVE-2025-58034 | FortiWeb | 2025-11-18 | CVSS 7.2, EPSS 56% |
| CVE-2025-64446 | FortiWeb | 2025-11-14 | CVSS 9.8, EPSS 92% |
| CVE-2025-25257 | FortiWeb | 2025-07-18 | CVSS 9.8, EPSS 97% |
Other Fortinet products
| CVE | Product | Added to KEV | Signals |
|---|---|---|---|
| CVE-2026-25089 | FortiSandbox | 2026-07-16 | CVSS 9.8, EPSS 74% |
| CVE-2026-39808 | FortiSandbox | 2026-07-16 | CVSS 9.8, EPSS 91% |
| CVE-2024-47575 | FortiManager | 2024-10-23 | CVSS 9.8, EPSS 95% |
| CVE-2023-27997 | FortiOS and FortiProxy SSL-VPN | 2023-06-13 | ransomware, CVSS 9.8, EPSS 86% |
| CVE-2018-13374 | FortiOS and FortiADC | 2022-09-08 | ransomware, CVSS 4.3, EPSS 38% |
Common questions about exploited Fortinet CVEs
Which Fortinet vulnerabilities are actively exploited?
As of August 2026, 29 Fortinet CVEs are on the CISA Known Exploited Vulnerabilities catalog, meaning exploitation in the wild is confirmed. The most-listed products are FortiOS (9), Multiple Products (5), FortiOS and FortiProxy (4), FortiClient EMS (3). 14 are linked to ransomware campaigns.
What is the newest exploited Fortinet CVE?
CVE-2025-68686, affecting FortiOS, added to the CISA KEV catalog on 2026-07-27. This page refreshes daily, so the newest entry is always first in the table.
How urgent are these Fortinet CVEs?
KEV listing is the strongest fix-first signal there is: it means confirmed exploitation, not a prediction. Patch these ahead of higher-CVSS issues that nobody is exploiting. Check the vendor advisory (linked below) for fixed versions and workarounds.
Can I ask my own AI about exploited Fortinet CVEs?
Yes. This page includes a free copy-paste AI prompt carrying the newest Fortinet KEV entries, with CVSS, EPSS, and ransomware context, into Claude, ChatGPT, or Copilot. The data is refreshed twice a day (5 AM and 3 PM US Central).
Authoritative references
All vendors, searchable with due dates and CSV export: the exploited-CVE tracker. Every vendor with a page: exploited by vendor.