Fortinet
Everything ChangeIntel collected about Fortinet from 1 source, on one timeline.
Watching for changes since 26 Sep 2026. Revisions the vendor made before then were not observed, which does not mean there were none.
Fortinet timeline
8 weeks back, 6 ahead · mark size shows importance, not volume- Release or post
- Known issue
- Out-of-band, exploited, or incident
- Revised by its source
- Deadline
SecurityMSRC · CISA KEV · security news
- Wed 12 Aug · Security advisory: FortiWeb: Content-Encoding WAF Evasion and 4 more
- Wed 12 Aug · Security advisory: FortiClient: Heap overflow in kernel driver due to missing size validation and 2 more (The vendor rates it high)
- Tue 8 Sep · Security advisory: FortiSOAR: Broken Access control on Websocket streams and 6 more
- Tue 8 Sep · Security advisory: FortiSandbox: Unauthenticated Control of NAT Rules Leading to Exposure of Sensitive Information and 3 more (The vendor rates it high)
- Wed 9 Sep · Fortinet · exploited, added to CISA KEV: Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability (CISA lists it as exploited)
- Thu 1 Oct · Fortinet · exploited, added to CISA KEV: Fortinet FortiMail Path Traversal Vulnerability and 1 more (CISA lists it as exploited)
2 changes2 critical
Fortinet changelog
RSSOctober 2026
- Issues and security Fortinet · exploited, added to CISA KEV · Fortinet FortiMail Path Traversal Vulnerability
- Issues and security Security advisory · Improper limitation of a pathname to a restricted directory
September 2026
- Issues and security Fortinet · exploited, added to CISA KEV · Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability
- Issues and security Security advisory · FortiSandbox: Unauthenticated Control of NAT Rules Leading to Exposure of Sensitive Information
- Issues and security Security advisory · Improper Authentication of FortiPAM Server
- Issues and security Security advisory · FortiMonitorOnSight: JWT used for authentication in web GUI signed with static key
- Issues and security Security advisory · FortiOS: ZTNA Portal Improper Certificate Validation
- Issues and security Security advisory · FortiSOAR: Broken Access control on Websocket streams
- Issues and security Security advisory · FortiClient: Arbitrary process termination from exposed minifilter communication port
- Issues and security Security advisory · FortiSandbox: Cron Job Injection in Remote Backup
- Issues and security Security advisory · Open Redirect on FortiSIEM
- Issues and security Security advisory · FortiManager: Workflow session email approval process bypass
- Issues and security Security advisory · FortiAnalyzer: Uncontrolled Resource Consumption in SNMP
- Issues and security Security advisory · FortiOS: Null Pointer Dereference in Log Report
August 2026
- Issues and security Security advisory · FortiClient: Heap overflow in kernel driver due to missing size validation
- Issues and security Security advisory · FortiWeb: Broken access control in the RADIUS type admin group
- Issues and security Security advisory · FortiManager: FGFM Authentication Weakening via CLI Configuration
- Issues and security Security advisory · FortiWeb: Content-Encoding WAF Evasion
- Issues and security Security advisory · FortiSIEM: Server-Side Request Forgery (SSRF)
- Issues and security Security advisory · FortiOS: Stack buffer overflow in WAD
- Issues and security Security advisory · FortiOS: UI DoS attack
- Issues and security Security advisory · HTTP/2 Bomb CVE-2026-49975
July 2026
- Issues and security Fortinet · exploited, added to CISA KEV · Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
- Issues and security Fortinet · exploited, added to CISA KEV · Fortinet FortiSandbox OS Command Injection Vulnerability
- Issues and security Fortinet · exploited, added to CISA KEV · Fortinet FortiSandbox OS Command Injection Vulnerability
- Issues and security Security advisory · FortiSandbox: Unauthenticated VNC access exposed on all interfaces
- Issues and security Security advisory · FortiAuthenticator: Out of bounds read in GUI
- Issues and security Security advisory · Missed certificate verification in AD Connector communication with FortiClient EMS
- Issues and security Security advisory · FortiOS: Stack Buffer Overflow in Log Report
- Issues and security Security advisory · FortiSIEM: Cross-Site Scripting in Domain parameter
- Issues and security Security advisory · FortiOS: SSL-VPN Reflected XSS
- Issues and security Security advisory · FortiOS: Path traversal in CLI command allows deletion of root file system
- Issues and security Security advisory · FortiOS: Header injection in Web Filter warning page
- Issues and security Security advisory · FortiOS: Header injection in captive portal authentication form
- Issues and security Security advisory · FortiOS: Buffer overread in authd and wad daemon
- Issues and security Security advisory · FortiSIEM: Supers override fails to properly override supervisor address
June 2026
- Issues and security Security advisory · FortiSandbox: Second-Order OS Command Injection via JSON Input on start vnc feature
- Issues and security Security advisory · FortiPortal: Improper access control in API endpoints
- Issues and security Security advisory · FortiOS: Restricted CLI escape using Lua
- Issues and security Security advisory · Linux Kernel vulnerability Dirty Frag
May 2026
- Issues and security Security advisory · Linux Kernel Vulnerability copy.fail - CVE-2026-31431
- Issues and security Security advisory · FortiAuthenticator: Improper access control on API endpoints
- Issues and security Security advisory · FortiSandbox: Incorrect global authorization
- Issues and security Security advisory · FortiClient: Hardcoded Encryption Key Used for VPN Saved Passwords
- Issues and security Security advisory · FortiTokenAndroid: OTP Disclosure via Exported TokenContentProvider
- Issues and security Security advisory · FortiAP: Command injection in CLI
- Issues and security Security advisory · FortiAP: OS command injection in CLI
- Issues and security Security advisory · FortiAnalyzer: DoS due to unsafe function in signal handler
- Issues and security Security advisory · FortiDeceptor: Arbitrary log file read in administrative interface
April 2026
- Issues and security Fortinet · exploited, added to CISA KEV · Fortinet FortiClient EMS SQL Injection Vulnerability
- Issues and security Fortinet · exploited, added to CISA KEV · Fortinet FortiClient EMS Improper Access Control Vulnerability
February 2026
- Issues and security Security advisory · FortiOS: LDAP authentication bypass in Agentless VPN and FSSO
January 2026
- Issues and security Fortinet · exploited, added to CISA KEV · Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability
December 2025
- Issues and security Fortinet · exploited, added to CISA KEV · Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability
November 2025
- Issues and security Fortinet · exploited, added to CISA KEV · Fortinet FortiWeb OS Command Injection Vulnerability
- Issues and security Security advisory · FortiOS: Trusted hosts bypass via SSH
- Issues and security Fortinet · exploited, added to CISA KEV · Fortinet FortiWeb Path Traversal Vulnerability
October 2025
- Issues and security Security advisory · FortiOS: Insertion of Sensitive 2FA Information in logs and debug command
Sorted from how each source classifies its records: what's-new pages, releases, documentation changes, notices, roadmap items, and network changes. A kind is a reading aid, not Microsoft's own category.
Nothing about Fortinet yet in: threads across sources, revisions by the vendor, open known issues, dates in the next 12 months, roadmap items in progress, versions.