Known vulnerabilities in FortiClientEMS

Software CPE: cpe:2.3:a:fortinet:forticlientems:*:*:*:*:*:*:*:*
Total vulnerabilities: 23
Public exploits: 3
Known exploited (KEV): 4
Highest CVSSv4 Score: 10

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting FortiClientEMS FortiClientEMS is affected by 23 known vulnerabilities: 3 critical, 2 high, 9 medium, 9 low Critical High Medium Low

Vulnerabilities (23)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU137524 - Improper Certificate Validation
CVE-2026-59836
CWE-295 Medium
No
No
7.4.6 14.07.2026 SB2026071491
#VU126113 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-39809
CWE-89 Low
No
No
7.2.13, 7.4.6 15.04.2026 SB2026041516
#VU125994 - Use of Hard-coded Cryptographic Key
CVE-2026-39810
CWE-321 Low
No
No
7.4.6 14.04.2026 SB20260414117
#VU124861 - Missing Authorization
CVE-2026-35616
CWE-862 Critical
No
Exploited
7.4.7 04.04.2026 SB2026040404
#VU122488 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-21643
CWE-89 Critical
No
Exploited
7.4.5 09.02.2026 SB2026020968
#VU121227 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-59922
CWE-89 Low
No
No
7.2.12, 7.4.5 13.01.2026 SB2026011366
#VU111044 - Improper Authentication
CVE-2024-32119
CWE-287 Medium
No
No
7.2.5, 7.4.1 11.06.2025 SB2025061109
#VU111043 - Server-Side Request Forgery (SSRF)
CVE-2023-48786
CWE-918 Low
No
No
7.2.7, 7.4.3 11.06.2025 SB2025061108
#VU109042 - Relative Path Traversal
CVE-2025-22859
CWE-23 Medium
No
No
7.4.3 13.05.2025 SB2025051362
#VU107355 - Improper Verification of Source of a Communication Channel
CVE-2024-36506
CWE-940 Low
No
No
7.2.5, 7.4.1 10.04.2025 SB2025041033
#VU107354 - Observable Response Discrepancy
CVE-2024-36510
CWE-204 Medium
No
No
7.2.5, 7.4.1 10.04.2025 SB2025041032
#VU107157 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-22855
CWE-79 Medium
No
No
7.4.3 08.04.2025 SB2025040848
#VU102601 - Improper Restriction of Excessive Authentication Attempts
CVE-2024-23106
CWE-307 Medium
No
No
7.0.11, 7.2.5 14.01.2025 SB2025011440
#VU97006 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2024-21753
CWE-22 Low
No
No
7.2.5 10.09.2024 SB2024091086
#VU97003 - Command injection
CVE-2024-33508
CWE-77 Medium
No
No
7.0.13, 7.2.5 10.09.2024 SB2024091083
#VU87378 - Improper Output Neutralization for Logs
CVE-2023-47534
CWE-117 Low
No
No
7.0.11, 7.2.3 12.03.2024 SB20240312318
#VU87359 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2023-48788
CWE-89 High
Available
Exploited
7.0.11, 7.2.3 12.03.2024 SB20240312306
#VU86284 - Improper Privilege Management
CVE-2023-45581
CWE-269 Medium
No
No
7.0.11, 7.2.3 09.02.2024 SB2024020909
#VU81072 - Exposure of sensitive information to an unauthorized actor
CVE-2021-44172
CWE-200 Low
No
No
7.0.8, 7.2.0 22.09.2023 SB2023092232
#VU80637 - Heap-based Buffer Overflow
CVE-2023-4863
CWE-122 Critical
Available
Exploited
7.0.10, 7.2.2 11.09.2023 SB2023091178
SB2023091245
SB2023091265
and 137 more


Showing elements 1 - 20 out of 23