Known vulnerabilities in FortiAuthenticator

Software CPE: cpe:2.3:a:fortinet:fortiauthenticator:*:*:*:*:*:*:*:*
Total vulnerabilities: 23
Public exploits: 3
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting FortiAuthenticator FortiAuthenticator is affected by 23 known vulnerabilities: 3 high, 7 medium, 13 low Critical High Medium Low

Vulnerabilities (23)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU137523 - Out-of-bounds read
CVE-2025-53379
CWE-125 Medium
No
No
6.5.8, 6.6.3 14.07.2026 SB2026071490
#VU131197 - Improper Access Control
CVE-2026-44277
CWE-284 High
No
No
6.5.7, 6.6.9, 8.0.3 12.05.2026 SB2026051292
#VU122533 - Missing Authorization
CVE-2026-21743
CWE-862 Low
No
No
6.6.7 10.02.2026 SB2026021042
#VU119451 - Direct Request ('Forced Browsing')
CVE-2025-57823
CWE-425 Low
No
No
6.6.7 09.12.2025 SB2025120960
#VU119445 - Improper Access Control
CVE-2025-59923
CWE-284 Low
No
No
6.6.7 09.12.2025 SB2025120956
#VU93513 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2024-6387
CWE-362 High
Available
No
6.6.2 01.07.2024 SB2024070144
SB2024070145
SB2024070152
and 89 more
#VU89566 - URL Redirection to Untrusted Site ('Open Redirect')
CVE-2024-23664
CWE-601 Low
No
No
6.5.4, 6.6.1 15.05.2024 SB2024051537
#VU74994 - Improper Restriction of Excessive Authentication Attempts
CVE-2022-29056
CWE-307 Low
No
No
6.5.0 12.04.2023 SB2023041203
#VU74974 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-35850
CWE-79 Medium
No
No
6.3.4, 6.4.5, 6.5.0 11.04.2023 SB2023041193
#VU72351 - Cleartext Storage of Sensitive Information
CVE-2022-22302
CWE-312 Low
No
No
6.0.5, 6.1.1, 6.2.0 17.02.2023 SB2023021715
#VU61391 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVE-2022-0778
CWE-835 Medium
Available
No
6.4.2 15.03.2022 SB2022031520
SB2022031522
SB2022031611
and 238 more
#VU61110 - Use of Uninitialized Resource
CVE-2022-0847
CWE-908 Low
Available
Exploited
6.3.4, 6.4.2 08.03.2022 SB2022030808
SB2022031019
SB2022031026
and 27 more
#VU60217 - Improper Access Control
CVE-2021-36177
CWE-284 Low
No
No
6.3.3 01.02.2022 SB2022020175
#VU56382 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2021-26116
CWE-78 Low
No
No
6.3.1 07.09.2021 SB2021090716
#VU55554 -
CVE-2021-22124
Medium
No
No
6.0.6, 6.1.0, 6.2.0, 6.3.0 03.08.2021 SB2021080316
SB2021080315
#VU53720 - Use of Hard-coded Cryptographic Key
CVE-2021-24005
CWE-321 Low
No
No
6.3.0 01.06.2021 SB2021060139
#VU24073 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-16154
CWE-79 Low
No
No
6.0.1 08.01.2020 SB2020010803
#VU37093 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2018-9186
CWE-79 Low
No
No
5.3.0 01.06.2018 SB2018060114
#VU40903 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2015-1459
CWE-79 Medium
No
No
- 03.02.2015 SB2015020303
#VU40904 - Permissions, Privileges, and Access Controls
CVE-2015-1458
CWE-264 High
No
No
- 03.02.2015 SB2015020303


Showing elements 1 - 20 out of 23