Known vulnerabilities in FortiAnalyzer 6.4.0

Software: FortiAnalyzer
Version: 6.4.0
Software CPE: cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*
Total vulnerabilities: 73
Public exploits: 5
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.4

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting FortiAnalyzer version 6.4.0 FortiAnalyzer 6.4.0 is affected by 73 vulnerabilities: 8 high, 24 medium, 41 low Critical High Medium Low

Vulnerabilities (73)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU123726 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-49784
CWE-89 Low
No
No
7.4.8, 7.6.5 10.03.2026 SB2026031088
#VU123717 - Hidden Functionality (Backdoor)
CVE-2025-48418
CWE-912 Low
No
No
7.0.15, 7.2.11, 7.4.8, 7.6.4 10.03.2026 SB2026031079
#VU123714 - Improper Restriction of Excessive Authentication Attempts
CVE-2026-22629
CWE-307 Low
No
No
7.6.5 10.03.2026 SB2026031076
#VU123712 - Improper Certificate Validation
CVE-2025-68482
CWE-295 Medium
No
No
7.4.9, 7.6.5 10.03.2026 SB2026031074
#VU117141 - Improper Authentication
CVE-2025-53845
CWE-287 Medium
No
No
7.4.7, 7.6.4 15.10.2025 SB2025101501
#VU117134 - Heap-based Buffer Overflow
CVE-2024-50571
CWE-122 Low
No
No
7.0.14, 7.2.10, 7.4.6, 7.6.3 14.10.2025 SB20251014106
#VU112527 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-24474
CWE-89 Low
No
No
7.4.7, 7.6.2 08.07.2025 SB2025070869
#VU107367 - Buffer Underwrite ('Buffer Underflow')
CVE-2024-35276
CWE-124 Medium
No
No
6.4.15, 7.0.13, 7.2.6, 7.4.4 10.04.2025 SB2025041041
#VU107362 - Improper Privilege Management
CVE-2024-45331
CWE-269 Low
No
No
7.2.6, 7.4.4 10.04.2025 SB2025041038
#VU107363 - Improper Privilege Management
CVE-2024-33503
CWE-269 Low
No
No
7.2.6, 7.4.4 10.04.2025 SB2025041038
#VU107312 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2024-40584
CWE-78 Low
No
No
7.2.6, 7.4.4 09.04.2025 SB2025040977
#VU107311 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2024-36508
CWE-22 Low
No
No
7.2.6, 7.4.3 09.04.2025 SB2025040976
#VU107250 - Improper Restriction of Communication Channel to Intended Endpoints
CVE-2024-50565
CWE-923 High
No
No
6.2.14, 6.4.15, 7.0.12, 7.2.5, 7.4.3 09.04.2025 SB2025040907
SB2025040908
SB2025040909
and 3 more
#VU107249 - Improper Restriction of Communication Channel to Intended Endpoints
CVE-2024-26013
CWE-923 High
No
No
6.2.14, 6.4.15, 7.0.12, 7.2.5, 7.4.3 09.04.2025 SB2025040907
SB2025040908
SB2025040909
and 3 more
#VU105614 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2024-33501
CWE-89 Low
No
No
7.2.6, 7.4.3 11.03.2025 SB20250311116
#VU105613 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2024-32123
CWE-78 Low
No
No
7.2.6, 7.4.4 11.03.2025 SB20250311115
#VU103834 - Information Exposure Through Log Files
CVE-2024-40585
CWE-532 Medium
No
No
6.2.12, 6.4.13, 7.0.9, 7.2.4, 7.4.1 11.02.2025 SB20250211166
SB20250211167
#VU103833 - Information Exposure Through Log Files
CVE-2024-52966
CWE-532 Low
No
No
7.2.8, 7.4.5, 7.6.1 11.02.2025 SB20250211158
#VU102600 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2024-33502
CWE-22 Low
No
No
7.2.6, 7.4.3 14.01.2025 SB2025011439
#VU100783 - Stack-based buffer overflow
CVE-2024-31496
CWE-121 Low
No
No
7.2.6, 7.4.3 21.11.2024 SB2024112169
SB2024112170


Showing elements 1 - 20 out of 73