Known vulnerabilities in FortiManager

Software: FortiManager
Software CPE: cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*
Total vulnerabilities: 112
Public exploits: 7
Known exploited (KEV): 2
Highest CVSSv4 Score: 9.4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting FortiManager FortiManager is affected by 112 known vulnerabilities: 2 critical, 13 high, 29 medium, 68 low Critical High Medium Low

Vulnerabilities (112)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU142456 - Authentication Bypass Using an Alternate Path or Channel
CVE-2026-70468
CWE-288 High
No
No
7.2.10, 7.4.6, 7.6.2 13.08.2026 SB20260813100
#VU131204 - Use of Potentially Dangerous Function
CVE-2025-67604
CWE-676 Low
No
No
7.4.9, 7.6.5 12.05.2026 SB2026051377
#VU126009 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2025-68649
CWE-22 Low
No
No
7.4.8, 7.6.5 14.04.2026 SB20260414132
#VU125996 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-61848
CWE-89 Low
No
No
7.4.9, 7.6.5 14.04.2026 SB20260414120
#VU123729 - Stack-based buffer overflow
CVE-2025-54820
CWE-121 Critical
No
No
7.2.11, 7.4.3 10.03.2026 SB2026031091
#VU123724 - Use of Externally-Controlled Format String
CVE-2025-68648
CWE-134 Low
No
No
7.4.8, 7.6.5 10.03.2026 SB2026031086
#VU123723 - Authentication Bypass Using an Alternate Path or Channel
CVE-2026-22572
CWE-288 Medium
No
No
7.4.8, 7.6.4 10.03.2026 SB2026031085
#VU123717 - Hidden Functionality (Backdoor)
CVE-2025-48418
CWE-912 Low
No
No
7.0.15, 7.2.11, 7.4.8, 7.6.4 10.03.2026 SB2026031079
#VU123714 - Improper Restriction of Excessive Authentication Attempts
CVE-2026-22629
CWE-307 Low
No
No
7.6.5 10.03.2026 SB2026031076
#VU123712 - Improper Certificate Validation
CVE-2025-68482
CWE-295 Medium
No
No
7.4.9, 7.6.5 10.03.2026 SB2026031074
#VU119426 - Key Management Errors
CVE-2024-40593
CWE-320 Low
No
No
7.2.6, 7.4.3 09.12.2025 SB2025120942
#VU117148 - Insertion of Sensitive Information Into Sent Data
CVE-2024-47569
CWE-201 Low
No
No
7.4.4, 7.6.2 15.10.2025 SB2025101507
#VU117134 - Heap-based Buffer Overflow
CVE-2024-50571
CWE-122 Low
No
No
7.0.14, 7.2.10, 7.4.6, 7.6.2 14.10.2025 SB20251014106
#VU113965 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2024-52964
CWE-22 Low
No
No
7.0.14, 7.2.10, 7.4.7, 7.6.2 12.08.2025 SB20250812101
#VU112527 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-24474
CWE-89 Low
No
No
7.4.7, 7.6.2 08.07.2025 SB2025070869
#VU109034 - Missing Authorization
CVE-2024-54020
CWE-862 Low
No
No
7.0.8, 7.2.2 13.05.2025 SB2025051336
#VU107382 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2024-50566
CWE-78 Low
No
Exploited
7.2.9, 7.4.6, 7.6.2 11.04.2025 SB2025041113
#VU107372 - Weak Authentication
CVE-2024-50563
CWE-1390 High
No
No
7.4.4, 7.6.2 10.04.2025 SB2025041046
#VU107373 - Weak Authentication
CVE-2024-48886
CWE-1390 High
No
No
7.4.4, 7.6.2 10.04.2025 SB2025041046
#VU104034 - Improper input validation
CVE-2025-26466
CWE-20 Medium
Available
No
7.2.11, 7.4.7, 7.6.3 18.02.2025 SB2025021815
SB2025021830
SB2025021840
and 25 more


Showing elements 1 - 20 out of 112