Fortinet vulnerabilities under active exploitation

23 CVEs on this page carry evidence of exploitation.

Which Fortinet vulnerabilities are being exploited?

22 of them are in the CISA KEV catalog.

• CVE-2026-0257 In KEV since 2026-05-29 · EPSS 96% · No fix identified here
• CVE-2026-21643 In KEV since 2026-04-13 · EPSS 94% · No fix identified here
• CVE-2026-20127 In KEV since 2026-02-25 · EPSS 88% · Fix identified
• CVE-2026-24858 In KEV since 2026-01-27 · EPSS 86% · No fix identified here
• CVE-2025-59718 In KEV since 2025-12-16 · EPSS 68% · No fix identified here
• CVE-2025-24472 In KEV since 2025-03-18 · EPSS 7% · Used in ransomware · No fix identified here
• CVE-2024-55591 In KEV since 2025-01-14 · EPSS 94% · Used in ransomware · No fix identified here
• CVE-2025-0282 In KEV since 2025-01-08 · EPSS 100.0% · Used in ransomware · Fix identified
• CVE-2024-36401 In KEV since 2024-07-15 · EPSS 99.8% · No fix identified here
• CVE-2024-21762 In KEV since 2024-02-09 · EPSS 83% · Used in ransomware · No fix identified here
• CVE-2024-21887 In KEV since 2024-01-10 · EPSS 100.0% · Used in ransomware · No fix identified here
• CVE-2023-46805 In KEV since 2024-01-10 · EPSS 100.0% · Used in ransomware · No fix identified here
• CVE-2023-46747 In KEV since 2023-10-31 · EPSS 97% · Used in ransomware · No fix identified here
• CVE-2023-32315 In KEV since 2023-08-24 · EPSS 100.0% · No fix identified here
• CVE-2023-27997 In KEV since 2023-06-13 · EPSS 86% · Used in ransomware · No fix identified here
• CVE-2022-42475 In KEV since 2022-12-13 · EPSS 99% · Used in ransomware · No fix identified here
• CVE-2022-40684 In KEV since 2022-10-11 · EPSS 100.0% · Used in ransomware · No fix identified here
• CVE-2022-1388 In KEV since 2022-05-10 · EPSS 100.0% · Used in ransomware · No fix identified here
• CVE-2020-1938 In KEV since 2022-03-03 · EPSS 99% · No fix identified here
• CVE-2018-13379 In KEV since 2021-11-03 · EPSS 100.0% · Used in ransomware · No fix identified here
• CVE-2021-26855 In KEV since 2021-11-03 · EPSS 100.0% · Used in ransomware · No fix identified here
• CVE-2021-22986 In KEV since 2021-11-03 · EPSS 99.9% · Used in ransomware · Fix identified
• CVE-2025-59719 EPSS 29% · No fix identified here

Which of them have a fix?

We can name a fix for 3 of them.

For the rest we hold no patch identifier, which is not the same as no patch existing.

What PlainSec published about Fortinet

• Hunt.io Found a Tailored 3BB Intrusion Kit (2026-09-16)
• Fortinet’s Fixes Expose a Server-Client Trust Gap (2026-09-10)
• Tenable and SentinelOne Find Vendor-Level Repeat Pressure (2026-08-27)
• FortiGuard Flags NGINX Heap Overflow in Appliances (2026-08-25)
• Gunra Shifts Ransomware to Perimeter Break-ins (2026-08-13)
• Sandworm Used Private APN to Reach CHP Controls (2026-08-13)
• Federal Buying Power Turns Against Legacy VPNs (2026-07-28)
• Edge Appliances Become Ransomware’s Preferred Front Door (2026-07-25)
• Patched FortiGates Still Leak Access Through Old Credentials (2026-07-09)
• Public Exploits Now Feed a Custom Cobalt Strike Loader (2026-06-27)
• FortiGate Compromise Becomes a Resale Pipeline (2026-06-25)
• FortiBleed Becomes a Credential-Resale Problem (2026-06-23)

Which Fortinet products this page tracks

• FortiAnalyzer
• FortiEDR
• FortiManager
• FortiOS
• Fortinet
• Fortinet FortiEDR
• Fortinet FortiGate
• Fortinet FortiGate Cloud
• Fortinet FortiOS

KEV and EPSS are re-checked daily. Page last updated 2026-09-25.