{ "schemaVersion": 1, "site": "https://cveboard.org", "generatedAt": "2026-10-23T21:07:04.814Z", "lastRun": "2026-10-23T21:01:12.729Z", "liveDays": 14, "filters": { "kind": null, "exploited": false, "severity": null, "ecosystems": [], "tag": "fortinet" }, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "incidents": [ { "id": "cve-2025-61624", "url": "https://cveboard.org/i/cve-2025-61624", "urlPt": "https://cveboard.org/pt/i/cve-2025-61624", "json": "https://cveboard.org/i/cve-2025-61624.json", "kind": "vuln", "live": true, "knownExploited": true, "severity": "moderate", "title": "Fortinet Multiple Products Path Traversal Vulnerability", "summary": "FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.", "titlePt": "Vulnerabilidade de Path Traversal em Múltiplos Produtos da Fortinet", "summaryPt": "FortiOS, FortiPAM, FortiProxy e FortiSwitchManager contêm uma vulnerabilidade de path traversal que pode permitir que um atacante autenticado com perfil de administrador e pelo menos permissões de leitura e gravação escreva ou exclua arquivos arbitrários por meio de comandos CLI específicos.", "affected": [ { "vendor": "Fortinet", "product": "FortiOS", "defaultStatus": "unaffected", "versions": [ { "version": "7.6.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "7.6.4" }, { "version": "7.4.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "7.4.9" }, { "version": "7.2.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "7.2.13" }, { "version": "7.0.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "7.0.19" }, { "version": "6.4.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "6.4.16" } ], "omitted": 0, "fixed": [] }, { "vendor": "Fortinet", "product": "FortiProxy", "defaultStatus": "unaffected", "versions": [ { "version": "7.6.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "7.6.4" }, { "version": "7.4.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "7.4.11" }, { "version": "7.2.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "7.2.16" }, { "version": "7.0.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "7.0.23" } ], "omitted": 0, "fixed": [] }, { "vendor": "Fortinet", "product": "FortiSwitchManager", "defaultStatus": "unaffected", "versions": [ { "version": "7.2.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "7.2.7" }, { "version": "7.0.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "7.0.6" } ], "omitted": 0, "fixed": [] }, { "vendor": "Fortinet", "product": "FortiPAM", "defaultStatus": "unaffected", "versions": [ { "version": "1.7.0", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": "1.6.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "1.6.2" }, { "version": "1.5.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "1.5.1" }, { "version": "1.4.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "1.4.3" }, { "version": "1.3.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "1.3.1" }, { "version": "1.2.0", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": "1.1.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "1.1.2" }, { "version": "1.0.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "1.0.3" } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [], "cwes": [ { "id": "CWE-22", "name": "Escalation of privilege" } ], "ssvc": { "exploitation": "active", "automatable": "no", "impact": "total", "at": "2026-10-15T00:00:00.000Z" }, "fix": "none", "tags": [ "fortinet" ], "cves": [ "CVE-2025-61624" ], "ghsa": null, "cvss": { "score": 5.4, "version": "3.1", "by": "fortinet" }, "epss": { "percentage": 0.01081, "percentile": 0.64866, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [], "vendor": "Fortinet", "product": "Multiple Products", "kev": { "dateAdded": "2026-10-16", "dueDate": "2026-10-19", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.", "ransomware": false }, "breach": null, "retracted": false, "sources": [ { "label": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-61624" } ], "cveVersion": 1, "cvePending": false, "publishedAt": "2026-10-16T00:00:00.000Z", "updatedAt": "2026-10-16T00:00:00.000Z" }, { "id": "cve-2026-104286", "url": "https://cveboard.org/i/cve-2026-104286", "urlPt": "https://cveboard.org/pt/i/cve-2026-104286", "json": "https://cveboard.org/i/cve-2026-104286.json", "kind": "vuln", "live": false, "knownExploited": true, "severity": "critical", "title": "Fortinet FortiMail Path Traversal Vulnerability", "summary": "Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.", "titlePt": "Vulnerabilidade de path traversal do Fortinet FortiMail", "summaryPt": "Fortinet FortiMail contém uma vulnerabilidade de path traversal e de neutralização inadequada de byte ou caractere NULL que pode permitir que um atacante não autenticado escreva arquivos arbitrários no sistema subjacente por meio de solicitações HTTP ou HTTPS manipuladas.", "affected": [ { "vendor": "Fortinet", "product": "FortiMail", "defaultStatus": "unaffected", "versions": [ { "version": "8.0.0", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": "7.6.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "7.6.5" }, { "version": "7.4.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "7.4.6" }, { "version": "7.2.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "7.2.9" }, { "version": "7.0.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "7.0.9" } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [], "cwes": [ { "id": "CWE-22", "name": "Execute unauthorized code or commands" } ], "ssvc": { "exploitation": "active", "automatable": "yes", "impact": "total", "at": "2026-10-02T03:55:37.976Z" }, "fix": "none", "tags": [ "fortinet" ], "cves": [ "CVE-2026-104286" ], "ghsa": null, "cvss": { "score": 9.8, "version": "3.1", "by": "fortinet" }, "epss": { "percentage": 0.02201, "percentile": 0.82394, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [], "vendor": "Fortinet", "product": "FortiMail", "kev": { "dateAdded": "2026-10-01", "dueDate": "2026-10-04", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.", "ransomware": false }, "breach": null, "retracted": false, "sources": [ { "label": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-104286" } ], "cveVersion": 1, "cvePending": false, "publishedAt": "2026-10-01T00:00:00.000Z", "updatedAt": "2026-10-01T00:00:00.000Z" } ], "tag": { "tag": "fortinet", "name": "Fortinet", "kev": { "name": "Fortinet", "total": 32, "last": "2026-10-16" } } }