KEV Tracker — CyberzSOC

⚠

About the KEV Catalog For the benefit of the cybersecurity community and network defenders — and to help every organization better manage vulnerabilities and keep pace with threat activity — CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework. Per Binding Operational Directive 26-04 (issued June 10, 2026, replacing BOD 22-01), federal civilian executive branch (FCEB) agencies must remediate each vulnerability within a timeline set by four factors: whether the asset is publicly exposed, whether the CVE is in the KEV catalog, whether exploitation is automatable, and technical impact. KEV status is now one input rather than the whole rule, and the most dangerous combinations call for remediation in three days plus forensic triage. Listings added before June 10, 2026 carry their original BOD 22-01 due dates. CISA strongly recommends all organizations — including private sector entities — prioritize remediation of KEV catalog vulnerabilities. View the full KEV catalog on CISA.gov →

Total KEVs — Fortinet

for Fortinet

Ransomware-Linked — Fortinet

44% of Fortinet's KEVs

Added Last 30 Days — Fortinet

3 in last 90 days

Latest Addition — Fortinet

2026-10-16

most recent for this vendor

Top Vendors

KEV count 20%+ ransomware-linked 41%+ ransomware-linked N RW · %Ransomware-linked share

Share of each bar's KEVs linked to ransomware. Thresholds track the catalog average of 20.4%, so they stay meaningful as it grows. Bars under 5 KEVs are left uncoloured — too few to rate a share.

Microsoft

390

117 RW · 30%

Cisco

102

7 RW · 7%

Apple

Adobe

11 RW · 13%

Google

Oracle

13 RW · 28%

Apache

8 RW · 20%

Ivanti

12 RW · 32%

Linux

2 RW · 6%

Fortinet

14 RW · 44%

Citrix

7 RW · 26%

VMware

9 RW · 35%

D-Link

2 RW · 8%

SonicWall

13 RW · 68%

Synacor

6 RW · 32%

Android

Palo Alto Networks

6 RW · 38%

Samsung

Atlassian

8 RW · 57%

SAP

3 RW · 21%

Top Products

KEV count 20%+ ransomware-linked 41%+ ransomware-linked N RW · %Ransomware-linked share

Share of each bar's KEVs linked to ransomware. Thresholds track the catalog average of 20.4%, so they stay meaningful as it grows. Bars under 5 KEVs are left uncoloured — too few to rate a share.

Windows · Microsoft

175

49 RW · 28%

Multiple Products · Apple

Chromium V8 · Google

Internet Explorer · Microsoft

6 RW · 17%

Flash Player · Adobe

5 RW · 15%

Kernel · Linux

2 RW · 6%

Office · Microsoft

3 RW · 10%

Win32k · Microsoft

11 RW · 44%

Exchange Server · Microsoft

13 RW · 76%

Zimbra Collaboration Suite (ZCS) · Synacor

5 RW · 29%

ColdFusion · Adobe

3 RW · 19%

SharePoint · Microsoft

8 RW · 53%

IOS and IOS XE Software · Cisco

Acrobat and Reader · Adobe

1 RW · 8%

PAN-OS · Palo Alto Networks

6 RW · 46%

Mobile Devices · Samsung

WebLogic Server · Oracle

2 RW · 17%

iOS, iPadOS, and macOS · Apple

Multiple Chipsets · Qualcomm

NetWeaver · SAP

2 RW · 20%

Clear 32 entries

BOD 26-04 window, if the asset is publicly exposed: 3 days + forensic triage 1466 3 days 151 14 days 151 Not publicly exposed, the 3-day tiers shrink to 14 days except total-control, automatable entries.

CVE	Vendor	Product	Vulnerability	CVSS	Added	Federal due date	BOD 26-04	Ransomware
CVE-2025-61624	Fortinet	Multiple Products	Fortinet Multiple Products Path Traversal Vulnerability FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.	5.4 CNA	2026-10-16	2026-10-19	3 days + forensic triage not automatable · total	Unknown
CVE-2026-104286	Fortinet	FortiMail	Fortinet FortiMail Path Traversal Vulnerability Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.	9.8 CNA	2026-10-01	2026-10-04	3 days + forensic triage automatable · total	Unknown
CVE-2025-25249	Fortinet	Multiple Products	Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets.	7.4 CNA	2026-09-09	2026-09-12	3 days + forensic triage not automatable · total	Unknown
CVE-2025-68686	Fortinet	FortiOS	Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.	5.3 CNA	2026-07-27	2026-08-10	14 days not automatable · partial	Unknown
CVE-2026-39808	Fortinet	FortiSandbox	Fortinet FortiSandbox OS Command Injection Vulnerability Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.	9.1 CNA	2026-07-16	2026-07-19	3 days + forensic triage automatable · total	Unknown
CVE-2026-25089	Fortinet	FortiSandbox	Fortinet FortiSandbox OS Command Injection Vulnerability Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.	9.1 CNA	2026-07-16	2026-07-19	3 days + forensic triage automatable · total	Unknown
CVE-2026-21643	Fortinet	FortiClient EMS	Fortinet FortiClient EMS SQL Injection Vulnerability Fortinet FortiClient EMS contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.	9.1 CNA	2026-04-13	2026-04-16	3 days + forensic triage automatable · total	Unknown
CVE-2026-35616	Fortinet	FortiClient EMS	Fortinet FortiClient EMS Improper Access Control Vulnerability Fortinet FortiClient EMS contains an improper access control vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.	9.1 CNA	2026-04-06	2026-04-09	3 days + forensic triage automatable · total	Unknown
CVE-2026-24858	Fortinet	Multiple Products	Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authentication bypass using an alternate path or channel that could allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.	9.4 CNA	2026-01-27	2026-01-30	3 days + forensic triage automatable · total	Unknown
CVE-2025-59718	Fortinet	Multiple Products	Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability Fortinet FortiOS, FortiSwitchMaster, FortiProxy, and FortiWeb contain an improper verification of cryptographic signature vulnerability that may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML message. Please be aware that CVE-2025-59719 pertains to the same problem and is mentioned in the same vendor advisory. Ensure to apply all patches mentioned in the advisory.	9.1 CNA	2025-12-16	2025-12-23	3 days + forensic triage automatable · total	Unknown
CVE-2025-58034	Fortinet	FortiWeb	Fortinet FortiWeb OS Command Injection Vulnerability Fortinet FortiWeb contains an OS command Injection vulnerability that may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.	6.7 CNA	2025-11-18	2025-11-25	3 days + forensic triage not automatable · total	Unknown
CVE-2025-64446	Fortinet	FortiWeb	Fortinet FortiWeb Path Traversal Vulnerability Fortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.	9.4 CNA	2025-11-14	2025-11-21	3 days + forensic triage automatable · total	Unknown
CVE-2025-25257	Fortinet	FortiWeb	Fortinet FortiWeb SQL Injection Vulnerability Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.	9.6 CNA	2025-07-18	2025-08-08	3 days + forensic triage automatable · total	Unknown
CVE-2019-6693	Fortinet	FortiOS	Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key.	6.5 CISA	2025-06-25	2025-07-16	14 days not automatable · partial	Known
CVE-2025-32756	Fortinet	Multiple Products	Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability Fortinet FortiFone, FortiVoice, FortiNDR and FortiMail contain a stack-based overflow vulnerability that may allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted HTTP requests.	9.6 CNA	2025-05-14	2025-06-04	3 days + forensic triage automatable · total	Unknown
CVE-2025-24472	Fortinet	FortiOS and FortiProxy	Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests.	8.1 CNA	2025-03-18	2025-04-08	3 days + forensic triage not automatable · total	Known Gunra Ransomware
CVE-2024-55591	Fortinet	FortiOS and FortiProxy	Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that may allow an unauthenticated, remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.	9.6 CNA	2025-01-14	2025-01-21	3 days + forensic triage automatable · total	Known Gunra Ransomware 2025-003: Critical Vulnerabilities in Fortinet Products
CVE-2024-47575	Fortinet	FortiManager	Fortinet FortiManager Missing Authentication Vulnerability Fortinet FortiManager contains a missing authentication vulnerability in the fgfmd daemon that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.	9.8 CNA	2024-10-23	2024-11-13	3 days + forensic triage not automatable · total	Unknown
CVE-2024-23113	Fortinet	Multiple Products	Fortinet Multiple Products Format String Vulnerability Fortinet FortiOS, FortiPAM, FortiProxy, and FortiWeb contain a format string vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.	9.8 CNA	2024-10-09	2024-10-30	3 days + forensic triage automatable · total	Unknown
CVE-2023-48788	Fortinet	FortiClient EMS	Fortinet FortiClient EMS SQL Injection Vulnerability Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an unauthenticated attacker to execute commands as SYSTEM via specifically crafted requests.	9.3 CNA	2024-03-25	2024-04-15	3 days + forensic triage automatable · total	Known Medusa Ransomware RansomHub Ransomware
CVE-2024-21762	Fortinet	FortiOS	Fortinet FortiOS Out-of-Bound Write Vulnerability Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remote unauthenticated attacker to execute code or commands via specially crafted HTTP requests.	9.6 CNA	2024-02-09	2024-02-16	3 days + forensic triage automatable · total	Known Fortinet Releases Advisory on New Post-Exploitation Technique for Known Vulnerabilities ICSA-25-044-06: Siemens RUGGEDCOM APE1808 People's Republic of China-Linked Actors Compromise Routers and IoT Devices for Botnet Operations Fortinet Releases Security Advisories for FortiOS 2024-018: Critical Vulnerabilities in FortiOS
CVE-2023-27997	Fortinet	FortiOS and FortiProxy SSL-VPN	Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests.	9.2 CNA	2023-06-13	2023-07-04	3 days + forensic triage automatable · total	Known Fortinet Releases Advisory on New Post-Exploitation Technique for Known Vulnerabilities ICSA-25-044-06: Siemens RUGGEDCOM APE1808 A method to assess 'forgivable' vs 'unforgivable' vulnerabilities 2023 Top Routinely Exploited Vulnerabilities People's Republic of China-Linked Actors Compromise Routers and IoT Devices for Botnet Operations RansomHub Ransomware North Korea Cyber Group Conducts Global Espionage Campaign to Advance Regime’s Military and Nuclear Programs North Korea Cyber Group Conducts Global Espionage Campaign to Advance Regime's Military and Nuclear Programs
CVE-2022-41328	Fortinet	FortiOS	Fortinet FortiOS Path Traversal Vulnerability Fortinet FortiOS contains a path traversal vulnerability that may allow a local privileged attacker to read and write files via crafted CLI commands.	6.5 CNA	2023-03-14	2023-04-04	3 days + forensic triage not automatable · total	Unknown
CVE-2022-42475	Fortinet	FortiOS	Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.	9.3 CNA	2022-12-13	2023-01-03	3 days + forensic triage automatable · total	Known Fortinet Releases Advisory on New Post-Exploitation Technique for Known Vulnerabilities ICSA-25-044-06: Siemens RUGGEDCOM APE1808 People's Republic of China-Linked Actors Compromise Routers and IoT Devices for Botnet Operations PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure
CVE-2022-40684	Fortinet	Multiple Products	Fortinet Multiple Products Authentication Bypass Vulnerability Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.	9.8 CNA	2022-10-11	2022-11-01	3 days + forensic triage automatable · total	Known
CVE-2018-13374	Fortinet	FortiOS and FortiADC	Fortinet FortiOS and FortiADC Improper Access Control Vulnerability Fortinet FortiOS and FortiADC contain an improper access control vulnerability that allows attackers to obtain the LDAP server login credentials configured in FortiGate by pointing a LDAP server connectivity test request to a rogue LDAP server.	4.3 CNA	2022-09-08	2022-09-29	14 days not automatable · partial	Known
CVE-2018-13383	Fortinet	FortiOS and FortiProxy	Fortinet FortiOS and FortiProxy Out-of-bounds Write A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users.	4.3 CNA	2022-01-10	2022-07-10	14 days not automatable · partial	Known
CVE-2018-13382	Fortinet	FortiOS and FortiProxy	Fortinet FortiOS and FortiProxy Improper Authorization An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password.	9.1 CNA	2022-01-10	2022-07-10	3 days + forensic triage automatable · total	Known
CVE-2021-44168	Fortinet	FortiOS	Fortinet FortiOS Arbitrary File Download Fortinet FortiOS "execute restore src-vis" downloads code without integrity checking, allowing an attacker to arbitrarily download files.	3.3 CNA	2021-12-10	2021-12-24	14 days not automatable · partial	Unknown
CVE-2018-13379	Fortinet	FortiOS	Fortinet FortiOS SSL VPN Path Traversal Vulnerability Fortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests.	9.1 CNA	2021-11-03	2022-05-03	3 days automatable · partial	Known Joint CSA: China-Linked Hacking Group QTFY Targets Military and Critical Infrastructure with Malicious Distributed Systems Play Ransomware CISA and Partners Release Advisory on Ghost (Cring) Ransomware Ghost (Cring) Ransomware 2023 Top Routinely Exploited Vulnerabilities Update on SVR Cyber Operations and Vulnerability Exploitation
CVE-2020-12812	Fortinet	FortiOS	Fortinet FortiOS SSL VPN Improper Authentication Vulnerability Fortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to login successfully without being prompted for the second factor of authentication (FortiToken) if they change the case in their username.	9.8 CISA	2021-11-03	2022-05-03	3 days + forensic triage automatable · total	Known Play Ransomware
CVE-2019-5591	Fortinet	FortiOS	Fortinet FortiOS Default Configuration Vulnerability Fortinet FortiOS contains a default configuration vulnerability that may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the Lightweight Directory Access Protocol (LDAP) server.	6.5 CISA	2021-11-03	2022-05-03	14 days not automatable · partial	Known

⚠ Known Exploited Vulnerability (KEV) Tracker

Top Vendors

Top Products