Filter by Date
- 2023
  - 1 03-2023
  - 1 02-2023
  - 1 01-2023
- 2022
  - 1 07-2022
  - 2 05-2022
  - 2 03-2022
- 2021
  - 6 11-2021
  - 6 08-2021
  - 1 07-2021
  - 1 06-2021
  - 1 01-2021
- 2020
  - 1 06-2020
  - 1 04-2020
  - 1 03-2020
- 2019
  - 2 11-2019
  - 1 07-2019
  - 1 04-2019
  - 1 02-2019
- 2018
  - 1 07-2018
- 2017
  - 2 04-2017
Filter by Severity
- 5 Critical
- 6 High
- 19 Medium
- 4 Low
- 0 Informational
Filter by Affected Product
- All
- 22 FortiPortal
- 11 FortiManager
- 10 FortiAnalyzer
- 9 FortiOS
- 9 FortiVoiceEnterprise
- 7 FortiWAN
- 7 FortiSwitch
- 6 FortiMail
- 6 FortiADC
- 6 FortiAP
- 6 FortiRecorder
- 5 AscenLink
- 4 FortiWeb
- 4 FortiSandbox
- 4 FortiAuthenticator
- 4 FortiAP-W2
- 4 FortiDDoS
- 4 FortiCache
- 3 FortiProxy
- 3 FortiClientWindows
- 3 FortiSIEM
- 3 FortiClientEMS
- 3 FortiTester
- 3 FortiAP-C
- 3 FortiIsolator
- 3 FortiWAN-Manager
- 2 FortiWLC
- 2 FortiClientMac
- 2 FortiAP-S
- 2 FortiAP-U
- 2 FortiDB
- 2 FortiADCManager
- 2 FortiTokenIOS
- 2 FortiClientAndroid
- 2 FortiDDoS-CM
- 2 SSL_VPN
- 1 FortiWLM
- 1 Meru AP
- 1 FortiExtender
- 1 FortiTokenAndroid
- 1 FSSO Windows CA
- 1 FortiClientiOS
- 1 FortiWebManager
- 1 Meru Controller
- 1 FSSO (all dist.)
- 1 FortiExplorer Windows
- 1 FortiFone
- 1 FortiVoice
- 0 FortiNAC
- 0 FortiSOAR
- 0 FortiDeceptor
- 0 FortiClientLinux
- 0 FortiEDR
- 0 FortiSIEMWindowsAgent
- 0 FortiSwitchManager
- 0 FortiNDR
- 0 FortiOS-6K7K
- 0 AV Engine
- 0 FSSO Windows DC Agent
- 0 FortiAnalyzer-BigData
- 0 FortiCloud
- 0 FortiDDoS-F
- 0 FortiGuard
- 0 FortiPresence
- 0 FortiSDNConnector
- 0 FortiTokenMobileWP

Refine Search

PSIRT Advisories

Monthly PSIRT Advisories

2023: May , Apr , Mar , Feb , Jan
2022: Dec , Nov , Sep , Aug , Jul , Jun , May , Apr , Mar , Feb
2021: Dec , Nov , Oct , Sep , Aug , Jul , Jun , May , Apr , Mar , Feb , Jan
2020: Dec

The following is a list of advisories for issues resolved in Fortinet products. The resolution of such issues is coordinated by the Fortinet Product Security Incident Response Team (PSIRT), a dedicated, global team that manages the receipt, investigation, and public reporting of information about security vulnerabilities and issues related to Fortinet products and services.

For details of how to raise a PSIRT Issue with Fortinet, please see our PSIRT Policy here.

FortiManager, FortiAnalyzer, FortiPortal & FortiSwitch - Information disclosure through diagnose debug commands

An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiManager, FortiAnalyzer, Fort...

FortiManager 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0, 5.6.9, 5.6.8, 5.6.7, 5.6.6, 5.6.5, 5.6.4, 5.6.3, 5.6.2, 5.6.11, 5.6.10, 5.6.1, 5.6.0 FortiAnalyzer 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0, 5.6.9, 5.6.8, 5.6.7, 5.6.6, 5.6.5, 5.6.4, 5.6.3, 5.6.2, 5.6.11, 5.6.10, 5.6.1, 5.6.0 FortiPortal 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0, 5.3.8, 5.3.7, 5.3.6, 5.3.5, 5.3.4, 5.3.3, 5.3.2, 5.3.1, 5.3.0, 5.2.6, 5.2.5, 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, 5.1.2, 5.1.1, 5.1.0, 5.0.3, 5.0.2, 5.0.1, 5.0.0, 4.2.2, 4.2.1, 4.2.0, 4.1.2, 4.1.1, 4.1.0 FortiSwitch 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0, 6.4.9, 6.4.8, 6.4.7, 6.4.6, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.10, 6.4.1, 6.4.0, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0

Mar 07, 2023 Severity black-background-circle-icon

Medium IR Number: FG-IR-18-232 CVE-2022-27490

FortiPortal - Device password exposure in audit log

An insertion of sensitive information into log file vulnerability [CWE-532] in the FortiPortal management interface may al...

FortiPortal 7.0.2, 7.0.1, 7.0.0

Feb 16, 2023 Severity black-background-circle-icon

Medium IR Number: FG-IR-22-430 CVE-2022-43954

FortiPortal - XSS observed on policy column settings

An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiPortal management interface ...

FortiPortal 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.11, 6.0.10, 6.0.1, 6.0.0, 5.3.8, 5.3.7, 5.3.6, 5.3.5, 5.3.4, 5.3.3, 5.3.2, 5.3.1, 5.3.0, 5.2.6, 5.2.5, 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, 5.1.2, 5.1.1, 5.1.0, 5.0.3, 5.0.2, 5.0.1, 5.0.0

Jan 03, 2023 Severity black-background-circle-icon

Medium IR Number: FG-IR-22-313 CVE-2022-41336

Multiple products - Integer overflow in dhcpd daemon

An integer overflow / wraparound vulnerability [CWE-190] in the FortiOS, FortiProxy, FortiSwitch, FortiRecoder, and FortiV...

FortiRecorder 6.4.2, 6.4.1, 6.4.0, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.10, 6.0.1, 6.0.0 FortiSwitch 7.0.2, 7.0.1, 7.0.0, 6.4.9, 6.4.8, 6.4.7, 6.4.6, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0 FortiOS 7.0.2, 7.0.1, 7.0.0, 6.4.7, 6.4.6, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.9, 6.2.8, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.10, 6.2.1, 6.2.0, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.16, 6.0.15, 6.0.14, 6.0.13, 6.0.12, 6.0.11, 6.0.10, 6.0.1, 6.0.0, 5.6.9, 5.6.8, 5.6.7, 5.6.6, 5.6.5, 5.6.4, 5.6.3, 5.6.2, 5.6.14, 5.6.13, 5.6.12, 5.6.11, 5.6.10, 5.6.1, 5.6.0, 5.4.9, 5.4.8, 5.4.7, 5.4.6, 5.4.5, 5.4.4, 5.4.3, 5.4.2, 5.4.13, 5.4.12, 5.4.11, 5.4.10, 5.4.1, 5.4.0 FortiProxy 7.0.0, 2.0.6, 2.0.5, 2.0.4, 2.0.3, 2.0.2, 2.0.1, 2.0.0, 1.2.9, 1.2.8, 1.2.7, 1.2.6, 1.2.5, 1.2.4, 1.2.3, 1.2.2, 1.2.13, 1.2.12, 1.2.11, 1.2.10, 1.2.1, 1.2.0, 1.1.6, 1.1.5, 1.1.4, 1.1.3, 1.1.2, 1.1.1, 1.1.0, 1.0.7, 1.0.6, 1.0.5, 1.0.4, 1.0.3, 1.0.2, 1.0.1, 1.0.0 FortiVoiceEnterprise 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.10, 6.0.1, 6.0.0, 5.3.8, 5.3.7, 5.3.6, 5.3.5, 5.3.4, 5.3.3, 5.3.26, 5.3.25, 5.3.24, 5.3.23, 5.3.22, 5.3.21, 5.3.20, 5.3.2, 5.3.19, 5.3.18, 5.3.17, 5.3.16, 5.3.15, 5.3.14, 5.3.13, 5.3.12, 5.3.11, 5.3.10, 5.3.1, 5.3.0

Jul 05, 2022 Severity black-background-circle-icon

Medium IR Number: FG-IR-21-155 CVE-2021-42755

FortiIsolator -- Unauthorized user able to regenerate CA certificate

An improper access control vulnerability [CWE-284] in FortiIsolator may allow an authenticated, non privileged attacker to...

FortiIsolator 2.3.2, 2.3.1, 2.3.0

May 03, 2022 Severity black-background-circle-icon

High IR Number: FG-IR-21-040 CVE-2021-41020

Multiple vulnerabilities in PJSIP library

Some advisories were released affecting the version of PJSIP library used in some Fortinet products: CVE-2021-43845: PJ...

FortiFone 3.0.9, 3.0.8, 3.0.7, 3.0.6, 3.0.5, 3.0.4, 3.0.3, 3.0.2, 3.0.11, 3.0.10, 3.0.1, 3.0.0 FortiVoiceEnterprise 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.10, 6.0.1, 6.0.0

May 03, 2022 Severity black-background-circle-icon

Critical IR Number: FG-IR-22-007 CVE-2021-37706

FortiAP-C - Command injection in CLI

An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] in FortiAP-C console may allow...

FortiAP-C 5.4.3, 5.4.2, 5.4.1, 5.4.0, 5.2.1, 5.2.0

Mar 01, 2022 Severity black-background-circle-icon

High IR Number: FG-IR-21-227 CVE-2022-22301

FortiPortal - Insecure password generation

The use of a cryptographically weak pseudo-random number generator (CWE-338) in the password reset feature of FortiPortal ...

FortiPortal 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0, 5.3.6, 5.3.5, 5.3.4, 5.3.3, 5.3.2, 5.3.1, 5.3.0, 5.2.6, 5.2.5, 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, 5.1.2, 5.1.1, 5.1.0, 5.0.3, 5.0.2, 5.0.1, 5.0.0, 4.2.2, 4.2.1, 4.1.2, 4.1.1, 4.1.0, 4.0.4, 4.0.3, 4.0.2, 4.0.1, 4.0.0

Mar 01, 2022 Severity black-background-circle-icon

High IR Number: FG-IR-21-099 CVE-2021-36171

FortiPortal - Denial of service vulnerabilities

Multiple uncontrolled resource consumption vulnerabilities [CWE-400] in the web interface of FortiPortal may allow a singl...

FortiPortal 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0, 5.3.5, 5.3.4, 5.3.3, 5.3.2, 5.3.1, 5.3.0, 5.2.5, 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, 5.1.2, 5.1.1, 5.1.0, 5.0.3, 5.0.2, 5.0.1, 5.0.0, 4.2.2, 4.2.1, 4.1.2, 4.1.1, 4.1.0, 4.0.4, 4.0.3, 4.0.2, 4.0.1, 4.0.0