DaystoPatch

VendorsEdge, Security

Fortinet

Fortinet makes FortiGate firewalls and the FortiOS operating system, FortiProxy, FortiWeb, FortiMail, FortiManager, FortiClient EMS and other security appliances and software.

Response trend, 6 months
Not enough history
Open now
None
Latest incident
1 Oct 2026
Incidents on record
16

Response to exploited bugs

80 range 70–91rank 6 of 10

Provisional 7 reviewed zero-days. Not enough yet for a firm grade.

Fixing privately reported bugs

70 range 62–78rank 10 of 20

Medium confidence, 9 private reports

What a grade means. B means the vendor met the public norm, such as a first fix within 7 days of the first public report or a private fix within 120 days. Taking half the norm time scores 92, an A. Taking twice the norm time scores 43, a D−. How grades work

Embed this report card

Why these grades

Every clock starts at the first public report.

  • Response to exploited bugs: B+ (80), provisional, from 7 reviewed zero-days in the last 36 months. Likely range 70 to 91.
  • First fix within a day for 2 of 7 zero-days. The other 5 took a median of 4 days, longest 17 days.
  • Every supported version fixed within a day for 2 of 6 zero-days. The other 4 took a median of 7 days, longest 25 days. 1 more has no public date for a fix to every version.
  • First advisory within a day for 3 of 7 zero-days. The other 4 took a median of 7 days, longest 39 days. Its advisory said the bug was being exploited in 7 of 7.
  • Fixing privately reported bugs: C+ (70). Median 161 days from private report to fix (9 cases, 3 with a vendor fix date). 7 of 9 took longer than ZDI's 120-day deadline. 5 of 9 concern FortiWeb.
  • 9 of 16 reviewed exploited bugs had a public fix before exploitation was reported. They do not count toward the response grade.

Response to exploited bugs: sub-scores

  • Time to first advisory3 of 7 zero-days within a day, longest 39 days
    75B
    7 cases, low confidence, weight 20%
  • Time to first fix2 of 7 zero-days within a day, longest 17 days
    79B
    7 cases, low confidence, weight 40%
  • Time to fix all versions2 of 6 zero-days within a day, longest 25 days
    84B+
    6 cases, low confidence, weight 30%
  • OpennessAdvisories published as CSAF. 7 of 7 zero-days with a dated revision history. 7 of 7 advisories said the bug was exploited. 6 of 7 fixed zero-days with a public fix date for every version. 2 of 5 zero-days not fixed within a day had an advisory or mitigation within 72 hours.
    88A−
    14 cases, high confidence, weight 10%

Fixing privately reported bugs: sub-score

  • Private fix speedMedian 161 days from private report to fix (9 cases, 3 with a vendor fix date)
    70C+
    9 cases, medium confidence, weight 100%

Response fingerprint

Median of 7 graded zero-days. Vendor statement 2d, first fix 4d, all versions 4d.

Compressed time scale

Counts toward the response grade 7

  1. 1 Oct 2026FortiMail unauthenticated arbitrary file write via IBE path traversal
  2. 14 Apr 2026FortiOS CLI path traversal used to escalate admin access to root (PEERSTITCH)
  3. 4 Apr 2026FortiClient EMS API authentication and authorization bypass (zero-day)
  4. 20 Jan 2026FortiCloud SSO authentication bypass used against fully patched FortiGates
  5. 6 Oct 2025FortiWeb GUI path confusion letting unauthenticated attackers run admin commands (fixed before public disclosure)
  6. 10 Jan 2025FortiOS and FortiProxy super-admin authentication bypass via Node.js websocket and CSF proxy
  7. 13 Oct 2024FortiManager fgfmd missing authentication allowing unauthenticated RCE ("FortiJump")
Not graded 10: n-days, unreviewed timelines and end-of-life products
  1. 9 Jun 2026FortiSandbox second-order OS command injection via the start-VNC featureNot graded: n-day
  2. 14 Apr 2026FortiSandbox unauthenticated command injection and auth bypass (April 2026 advisories)Not graded: n-day
  3. 10 Feb 2026FortiOS SSL-VPN symlink persistence patch bypass (information disclosure)Not graded: n-day
  4. 6 Feb 2026FortiClient EMS 7.4.4 unauthenticated SQL injection in the administrative interfaceNot graded: n-day
  5. 13 Jan 2026FortiOS and FortiSwitchManager cw_acd (CAPWAP) heap overflow allowing unauthenticated RCENot graded: n-day
  6. 9 Dec 2025FortiCloud SSO login authentication bypass via crafted SAML messageNot graded: n-day
  7. 18 Nov 2025FortiWeb authenticated OS command injection exploited in the wildNot graded: n-day
  8. 8 Jul 2025FortiWeb Fabric Connector unauthenticated SQL injection leading to RCENot graded: n-day
  9. 13 May 2025Fortinet API stack overflow (FortiVoice, FortiMail, FortiNDR, FortiRecorder, FortiCamera) exploited on FortiVoiceNot graded: n-day
  10. 19 Nov 2019FortiOS hard-coded key used to encrypt secrets in configuration backupsNot graded: n-day
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Open, no fix
  • Open, partly fixed
  • Fixed when disclosed
  • Date only, no time of day

One row per exploited incident, newest first. A tick at the start means a fix existed when the bug went public.

Exploited incidents

16 in 24 months, 3 with known ransomware use, 41% exploited before a fix

First reportIncidentCVSSSilenceFirst fixAll fixedStatusGrade
1 Oct 2026FortiMail unauthenticated arbitrary file write via IBE path traversalCVE-2026-1042869.80h4d4dFixedCounts toward grade
9 Jun 2026FortiSandbox second-order OS command injection via the start-VNC featureCVE-2026-250899.80hsame daysame dayFixedNot graded: n-day
14 Apr 2026FortiSandbox unauthenticated command injection and auth bypass (April 2026 advisories)CVE-2026-39808, CVE-2026-398139.80hsame daysame dayFixedNot graded: n-day
14 Apr 2026FortiOS CLI path traversal used to escalate admin access to root (PEERSTITCH)CVE-2025-616246.0same daysame daysame dayFixedCounts toward grade
4 Apr 2026FortiClient EMS API authentication and authorization bypass (zero-day)CVE-2026-356169.80hsame daysame dayFixedCounts toward grade
10 Feb 2026FortiOS SSL-VPN symlink persistence patch bypass (information disclosure)CVE-2025-686865.9same daysame daysame dayFixedNot graded: n-day
6 Feb 2026FortiClient EMS 7.4.4 unauthenticated SQL injection in the administrative interfaceCVE-2026-216439.8same daysame daysame dayFixedNot graded: n-day
20 Jan 2026FortiCloud SSO authentication bypass used against fully patched FortiGatesCVE-2026-248589.82d8dnot datedFixedCounts toward grade
13 Jan 2026FortiOS and FortiSwitchManager cw_acd (CAPWAP) heap overflow allowing unauthenticated RCECVE-2025-252498.1same daysame daysame dayFixedNot graded: n-day
9 Dec 2025FortiCloud SSO login authentication bypass via crafted SAML messageCVE-2025-59718, CVE-2025-597199.8same daysame daysame dayFixedNot graded: n-day
18 Nov 2025FortiWeb authenticated OS command injection exploited in the wildCVE-2025-580347.20hsame daysame dayFixedNot graded: n-day
6 Oct 2025FortiWeb GUI path confusion letting unauthenticated attackers run admin commands (fixed before public disclosure)CVE-2025-644469.839d17d25dFixedCounts toward grade
Show 5 more incidents
First reportIncidentCVSSSilenceFirst fixAll fixedStatusGrade
8 Jul 2025FortiWeb Fabric Connector unauthenticated SQL injection leading to RCECVE-2025-252579.8same daysame daysame dayFixedNot graded: n-day
13 May 2025Fortinet API stack overflow (FortiVoice, FortiMail, FortiNDR, FortiRecorder, FortiCamera) exploited on FortiVoiceCVE-2025-327569.80hsame daysame dayFixedNot graded: n-day
10 Jan 2025FortiOS and FortiProxy super-admin authentication bypass via Node.js websocket and CSF proxyCVE-2024-55591, CVE-2025-244729.84d4d4dFixedCounts toward grade
13 Oct 2024FortiManager fgfmd missing authentication allowing unauthenticated RCE ("FortiJump")CVE-2024-475759.810d4d10dFixedCounts toward grade
19 Nov 2019FortiOS hard-coded key used to encrypt secrets in configuration backupsCVE-2019-66934.3same daysame daysame dayFixedNot graded: n-day

Private reports

Median 161 days, 78% over 120 days, 0 published unpatched

Bugs reported privately to Fortinet by ZDI or Project Zero.

One tick per graded report. Counts to the vendor's fix when its date is known, else to publication. Taller ticks were published before a fix existed.
PublishedAdvisoryProductDays from report to fix or to publication. Tick: ZDI's 120-day deadline.Patch at publication
15 Oct 2026ZDI-26-771, ZDI-26-772CVE-2026-106170, CVE-2026-107656FortiSandbox116to vendor fix, 13 Oct 2026Yes
9 Sep 2026ZDI-26-645CVE-2026-84387FortiSandbox168to vendor fix, 8 Sep 2026Yes
15 Apr 2026ZDI-26-265, ZDI-26-266CVE-2026-39811, CVE-2026-40688FortiWeb127to publicationYes
10 Mar 2026ZDI-26-186CVE-2026-24018FortiClient132to publicationYes
19 Feb 2026ZDI-25-1095, ZDI-25-1096, ZDI-25-1097, ZDI-25-1098, ZDI-26-048, ZDI-26-115CVE-2025-53949, CVE-2025-54353, CVE-2025-62676, CVE-2025-67685FortiSandbox; FortiClient VPN266to publicationYes
16 Dec 2025ZDI-25-1094CVE-2025-64447FortiWeb67to publicationYes
19 Nov 2025ZDI-25-918, ZDI-25-1014CVE-2025-53609, CVE-2025-58034FortiWeb161to vendor fix, 18 Nov 2025Yes
13 May 2025ZDI-25-288CVE-2025-25254FortiWeb189to publicationYes
7 Apr 2025ZDI-25-094, ZDI-25-095, ZDI-25-202CVE-2024-50567, CVE-2024-50569, CVE-2024-55597FortiWeb173to publicationYes

Advisories changed after publication

11 shown, 9 without a revision note

  1. FG-IR-26-175

    Recorded in the revision history

    Improper limitation of a pathname to a restricted directory

    Version table: 3 rows added and 3 rows removed. One new row reads "FortiMail 8.0 | 8.0.0 through 8.0.1 | Upgrade to 8.0.2 or above".

    • Fixed versions
    Version table rows
    BeforeFortiMail 8.0 | 8.0.0 through 8.0.1 | Upgrade to upcoming 8.0.2 or above; FortiMail 7.6 | 7.6.0 through 7.6.6 | Upgrade to upcoming 7.6.7 or above; FortiMail 7.4 | 7.4.0 through 7.4.8 | Upgrade to upcoming 7.4.9 or above
    AfterFortiMail 8.0 | 8.0.0 through 8.0.1 | Upgrade to 8.0.2 or above; FortiMail 7.6 | 7.6.0 through 7.6.6 | Upgrade to 7.6.7 or above; FortiMail 7.4 | 7.4.0 through 7.4.8 | Upgrade to 7.4.9 or above
    Earlier version captured 3 Oct 2026, 17:05 UTC: archived copyLater version captured 14 Oct 2026, 18:26 UTC: archived copyRecovered from archived copiesSnapshots 883026fdf5… and bb5101cbfa…Incident page

  2. FG-IR-26-175

    Changed without a revision note

    Improper limitation of a pathname to a restricted directory

    Workaround text changed.

    • Workaround
    Workaround
    BeforeDisable the IBE feature support using the following CLI command: config system encryption ibe set status disable end Alternatively: Disable access to the FortiMail management interface from the internet or limit the access only from trusted private network Indicators of Compromise (IoC): Files: * [A
    AfterDisable the IBE feature support via the GUI ( Encryption -> IBE -> IBE Service 'off' ) or with the following CLI command: config system encryption ibe set status disable end Alternatively: - Disable access to the FortiMail webmail interface from the internet or limit the access only from trusted pri
    Earlier version captured 2 Oct 2026, 08:57 UTC: archived copyLater version captured 3 Oct 2026, 13:10 UTC: archived copyRecovered from archived copiesSnapshots dadc1b25bb… and aecd073f00…Incident page
Show 9 more changes

  1. FG-IR-26-060

    Changed without a revision note

    Administrative FortiCloud SSO authentication bypass

    Version table: 2 rows added and 1 row removed. One new row reads "FortiNAC-F 7.6 | 7.6.3 through 7.6.5 | Upgrade to 7.6.6 or above".

    • Fixed versions
    Version table rows
    BeforeFortiSwitchManager 7.0 | 7.0.0 through 7.0.7 | Upgrade to upcoming 7.0.8 or above
    AfterFortiNAC-F 7.6 | 7.6.3 through 7.6.5 | Upgrade to 7.6.6 or above; FortiSwitchManager 7.0 | 7.0.0 through 7.0.7 | Upgrade to 7.0.8 or above
    Verbatim wording. Removed text is struck through. Added text is bold.
    Before

    or above FortiProxy 7.0 | 7.0.0 through 7.0.22 | Upgrade to 7.0.23 or above FortiSwitchManager 7.2 | 7.2.0 through 7.2.8 | Upgrade to 7.2.9 or above FortiSwitchManager 7.0 | 7.0.0 through 7.0.7 | Upgrade to upcoming 7.0.8 or above FortiWeb 8.0 | 8.0.0 through 8.0.3 | Upgrade to 8.0.4 or above FortiWeb 7.6 | 7.6.0 through 7.6.6 | Upgrade to 7.6.7 or above FortiWeb 7.4 | 7.4.0 through 7.4.11 | Upgr

    After

    11 | Upgrade to 7.2.12 or above FortiManager 7.0 | 7.0.0 through 7.0.15 | Upgrade to 7.0.16 or above FortiManager 6.4 | Not affected | Not Applicable FortiNAC-F 7.6 | 7.6.3 through 7.6.5 | Upgrade to 7.6.6 or above FortiNAC-F 7.4 | Not affected | Not Applicable FortiNAC-F 7.2 | Not affected | Not Applicable FortiOS 8.0 | Not affected | Not Applicable FortiOS 7.6 | 7.6.0 through 7.6.5 | Upgrade to

    Earlier version captured 21 Feb 2026, 11:20 UTC: archived copyLater version captured 9 Jul 2026, 15:43 UTC: archived copyRecovered from archived copiesSnapshots e4573e1a2f… and 9cdc135f0c…Incident page

  2. FG-IR-26-099

    Changed without a revision note

    API authentication and authorization bypass

    Version table: 1 row added and 1 row removed. One new row reads "FortiClientEMS 7.4 | 7.4.5 through 7.4.6 | Upgrade to 7.4.7 or above".

    • Fixed versions
    Version table rows
    BeforeFortiClientEMS 7.4 | 7.4.5 through 7.4.6 | Upgrade to upcoming 7.4.7 or above
    AfterFortiClientEMS 7.4 | 7.4.5 through 7.4.6 | Upgrade to 7.4.7 or above
    Verbatim wording. Removed text is struck through. Added text is bold.
    Before

    MS 7.4.7 will also include a fix for this issue. In the meantime the hotfix above is sufficient to prevent it entirely. Version | Affected | Solution FortiClientEMS 7.4 | 7.4.5 through 7.4.6 | Upgrade to upcoming 7.4.7 or above FortiClientEMS 7.2 | Not affected | Not Applicable Fortinet remediated this issue in FortiClient Cloud and hence customers do not need to perform any action. Fortinet remed

    After

    MS 7.4.7 will also include a fix for this issue. In the meantime the hotfix above is sufficient to prevent it entirely. Version | Affected | Solution FortiClientEMS 7.4 | 7.4.5 through 7.4.6 | Upgrade to 7.4.7 or above FortiClientEMS 7.2 | Not affected | Not Applicable Fortinet remediated this issue in FortiClient Cloud and hence customers do not need to perform any action. Fortinet remediated thi

    Earlier version captured 8 Apr 2026, 09:23 UTC: archived copyLater version captured 17 May 2026, 20:56 UTC: archived copyRecovered from archived copiesSnapshots ddd99ae9c2… and af6309f232…Incident page

  3. FG-IR-25-1142

    Changed without a revision note

    SQLi in administrative interface

    Advisory now says the bug is exploited (earlier version: vendor not aware).

    • Exploitation status
    Exploitation status
    Beforevendor not aware of exploitation
    Aftervendor aware of exploitation
    Earlier version captured 30 Mar 2026, 13:37 UTC: archived copyLater version captured 8 Apr 2026, 03:53 UTC: archived copyRecovered from archived copiesSnapshots 7d47085556… and 5b98d3fa48…Incident page

  4. FG-IR-26-060

    Changed without a revision note

    Administrative FortiCloud SSO authentication bypass

    Version table: 15 rows added and 13 rows removed. One new row reads "FortiAnalyzer 7.2 | 7.2.0 through 7.2.11 | Upgrade to 7.2.12 or above".

    • Fixed versions
    Version table rows
    BeforeFortiAnalyzer 7.2 | 7.2.0 through 7.2.11 | Upgrade to upcoming 7.2.12 or above; FortiAnalyzer 7.0 | 7.0.0 through 7.0.15 | Upgrade to upcoming 7.0.16 or above; FortiManager 7.2 | 7.2.0 through 7.2.11 | Upgrade to upcoming 7.2.12 or above; FortiManager 7.0 | 7.0.0 through 7.0.15 | Upgrade to upcoming
    AfterFortiAnalyzer 7.2 | 7.2.0 through 7.2.11 | Upgrade to 7.2.12 or above; FortiAnalyzer 7.0 | 7.0.0 through 7.0.15 | Upgrade to 7.0.16 or above; FortiManager 7.2 | 7.2.0 through 7.2.11 | Upgrade to 7.2.12 or above; FortiManager 7.0 | 7.0.0 through 7.0.15 | Upgrade to 7.0.16 or above
    Earlier version captured 3 Feb 2026, 01:15 UTC: archived copyLater version captured 21 Feb 2026, 11:20 UTC: archived copyRecovered from archived copiesSnapshots 808d80ebbc… and e4573e1a2f…Incident page

  5. FG-IR-26-060

    Changed without a revision note

    Administrative FortiCloud SSO authentication bypass

    Version table: 6 rows added and 4 rows removed. One new row reads "FortiAnalyzer 7.6 | 7.6.0 through 7.6.5 | Upgrade to 7.6.6 or above".

    • Fixed versions
    Version table rows
    BeforeFortiAnalyzer 7.6 | 7.6.0 through 7.6.5 | Upgrade to upcoming 7.6.6 or above; FortiManager 7.6 | 7.6.0 through 7.6.5 | Upgrade to upcoming 7.6.6 or above; FortiManager 7.2 | 7.2.0 through 7.2.11 | Upgrade to upcoming 7.2.13 or above; FortiOS 7.6 | 7.6.0 through 7.6.5 | Upgrade to upcoming 7.6.6 or a
    AfterFortiAnalyzer 7.6 | 7.6.0 through 7.6.5 | Upgrade to 7.6.6 or above; FortiManager 7.6 | 7.6.0 through 7.6.5 | Upgrade to 7.6.6 or above; FortiManager 7.2 | 7.2.0 through 7.2.11 | Upgrade to upcoming 7.2.12 or above; FortiOS 7.6 | 7.6.0 through 7.6.5 | Upgrade to 7.6.6 or above
    Earlier version captured 29 Jan 2026, 07:12 UTC: archived copyLater version captured 31 Jan 2026, 13:18 UTC: archived copyRecovered from archived copiesSnapshots 489f6a4225… and 6e2496bb6a…Incident page

  6. FG-IR-26-060

    Changed without a revision note

    Administrative FortiCloud SSO authentication bypass

    Version table: 3 rows added. One new row reads "FortiWeb 8.0 | 8.0.0 through 8.0.3 | Upgrade to upcoming 8.0.4 or above".

    • Fixed versions
    Version table rows
    Beforenot present
    AfterFortiWeb 8.0 | 8.0.0 through 8.0.3 | Upgrade to upcoming 8.0.4 or above; FortiWeb 7.6 | 7.6.0 through 7.6.6 | Upgrade to upcoming 7.6.7 or above; FortiWeb 7.4 | 7.4.0 through 7.4.11 | Upgrade to upcoming 7.4.12 or above
    Earlier version captured 28 Jan 2026, 02:01 UTC: archived copyLater version captured 28 Jan 2026, 19:27 UTC: archived copyRecovered from archived copiesSnapshots 8cd7570427… and 39cba51206…Incident page

  7. FG-IR-26-060

    Changed without a revision note

    Administrative FortiCloud SSO authentication bypass

    Version table: 3 rows added and 3 rows removed. One new row reads "FortiAnalyzer 7.4 | 7.4.0 through 7.4.9 | Upgrade to 7.4.10 or above". Workaround text changed.

    • Fixed versions
    • Workaround
    Version table rows
    BeforeFortiAnalyzer 7.4 | 7.4.0 through 7.4.9 | Upgrade to upcoming 7.4.10 or above; FortiManager 7.4 | 7.4.0 through 7.4.9 | Upgrade to upcoming 7.4.10 or above; FortiOS 7.4 | 7.4.0 through 7.4.10 | Upgrade to upcoming 7.4.11 or above
    AfterFortiAnalyzer 7.4 | 7.4.0 through 7.4.9 | Upgrade to 7.4.10 or above; FortiManager 7.4 | 7.4.0 through 7.4.9 | Upgrade to 7.4.10 or above; FortiOS 7.4 | 7.4.0 through 7.4.10 | Upgrade to 7.4.11 or above
    Workaround
    BeforeFortiCloud SSO authentication no longer supports login from devices running vulnerable versions. Therefore disabling FortiCloud SSO login on client side is not necessary at the moment. For reference, it can be nonetheless be done via the following: go to System -> Settings -> Switch "Allow administr
    AfterFortiCloud SSO authentication no longer supports login from devices running vulnerable versions. Therefore disabling FortiCloud SSO login on client side is not necessary at the moment. For reference, it can be nonetheless be done via the following: On FortiOS and FortiProxy: go to System -> Settings
    Earlier version captured 27 Jan 2026, 22:53 UTC: archived copyLater version captured 28 Jan 2026, 02:01 UTC: archived copyRecovered from archived copiesSnapshots 9a28e614bf… and 8cd7570427…Incident page

  8. FG-IR-25-910

    Changed without a revision note

    Path confusion vulnerability in GUI

    CVSS exploit maturity changed from functional to high (displayed score 9.1 to 9.4).

    • Severity
    CVSS exploit maturity
    Beforefunctional
    Afterhigh
    Earlier version captured 17 Nov 2025, 09:42 UTC: archived copyLater version captured 25 Nov 2025, 12:26 UTC: archived copyRecovered from archived copiesSnapshots 6ca5019f4f… and b555c40285…Incident page

  9. FG-IR-25-151

    Recorded in the revision history

    Unauthenticated SQL injection in GUI

    Advisory now says the bug is exploited.

    • Exploitation status
    Exploitation status
    Beforenot stated
    Aftervendor aware of exploitation
    Earlier version captured 17 Jul 2025, 04:07 UTC: archived copyLater version captured 18 Jul 2025, 10:21 UTC: archived copyRecovered from archived copiesSnapshots d9acc11387… and e565c3665e…Incident page

Grade history

Response to exploited bugs: score at the end of each month.

Show as a table
MonthScoreGrade
Nov 202572B−
Dec 202572B−
Jan 202673B−
Feb 202673B−
Mar 202673B−
Apr 202678B
May 202678B
Jun 202678B
Jul 202678B
Aug 202678B
Sep 202678B
Oct 202680B+

Channels

Get Fortinet's own alerts

What we watch

  • RSSFortiGuard PSIRT advisories RSS
  • RSSFortinet firmware releases RSS
  • BlogFortinet PSIRT blog RSS

See sources and health for when each was last read.