Fortinet FortiOS known exploited vulnerabilities, ranked
CISA lists 9 Fortinet FortiOS CVEs as exploited in the wild. 1 were added in the last 12 months and 6 are known to be used in ransomware. The table ranks all of them by EPSS, FIRST's estimate of the chance a CVE is exploited in the next 30 days, so the first rows are the ones to patch first.
Patch these first
- CVE-2018-13379: EPSS 100.00%, used in ransomware, added 2021-11-03
- CVE-2022-42475: EPSS 99.47%, used in ransomware, added 2022-12-13
- CVE-2024-21762: EPSS 83.4%, used in ransomware, added 2024-02-09
- CVE-2020-12812: EPSS 45.4%, used in ransomware, added 2021-11-03
- CVE-2025-68686: EPSS 29.6%, added 2026-07-27
All 9 Fortinet FortiOS CVEs in CISA KEV, by EPSS
| # | CVE | Flaw | EPSS | Ransomware | Added | Federal due |
|---|---|---|---|---|---|---|
| 1 | CVE-2018-13379 | FortiOS SSL VPN Path Traversal | 100.00% | Yes | 2021-11-03 | 2022-05-03 |
| 2 | CVE-2022-42475 | FortiOS Heap-Based Buffer Overflow | 99.47% | Yes | 2022-12-13 | 2023-01-03 |
| 3 | CVE-2024-21762 | FortiOS Out-of-Bound Write | 83.4% | Yes | 2024-02-09 | 2024-02-16 |
| 4 | CVE-2020-12812 | FortiOS SSL VPN Improper Authentication | 45.4% | Yes | 2021-11-03 | 2022-05-03 |
| 5 | CVE-2025-68686 | FortiOS Exposure of Sensitive Information to an Unauthorized Actor | 29.6% | – | 2026-07-27 | 2026-08-10 |
| 6 | CVE-2019-5591 | FortiOS Default Configuration | 18.4% | Yes | 2021-11-03 | 2022-05-03 |
| 7 | CVE-2022-41328 | FortiOS Path Traversal | 10.7% | – | 2023-03-14 | 2023-04-04 |
| 8 | CVE-2019-6693 | FortiOS Use of Hard-Coded Credentials | 5.8% | Yes | 2025-06-25 | 2025-07-16 |
| 9 | CVE-2021-44168 | FortiOS Arbitrary File Download | 0.9% | – | 2021-12-10 | 2021-12-24 |
EPSS changes daily; a CVE with a low EPSS that is in KEV is still exploited somewhere. Federal due dates bind US federal civilian agencies; everyone else can use them as a priority hint.
Sources: CISA KEV, FIRST EPSS.
More: all Fortinet KEV CVEs · other Fortinet products: Multiple Products · free KEV badge for Fortinet · all vendors