Known vulnerabilities in Fortinet FortiClient for Windows

Software CPE: cpe:2.3:a:fortinet:fortinet_forticlient:*:*:*:*:*:*:*:*
Total vulnerabilities: 49
Public exploits: 1
Known exploited (KEV): 2
Highest CVSSv4 Score: 9.4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Fortinet FortiClient for Windows Fortinet FortiClient for Windows is affected by 49 known vulnerabilities: 1 critical, 4 high, 12 medium, 32 low Critical High Medium Low

Vulnerabilities (49)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU142459 - Buffer overflow
CVE-2026-70465
CWE-120 High
No
No
7.2.12, 7.4.4 13.08.2026 SB20260813103
#VU131198 - Missing Authorization
CVE-2026-44278
CWE-862 Low
No
No
7.4.3 12.05.2026 SB2026051293
#VU122534 - Improper Link Resolution Before File Access ('Link Following')
CVE-2025-62676
CWE-59 Low
No
No
7.2.13, 7.4.5 10.02.2026 SB2026021043
#VU118610 - Active Debug Code
CVE-2025-54660
CWE-489 Low
No
No
7.2.11, 7.4.4 18.11.2025 SB2025111879
#VU118598 - Heap-based Buffer Overflow
CVE-2025-46373
CWE-122 Low
No
No
7.2.9, 7.4.4 18.11.2025 SB2025111867
#VU118597 - Exposed IOCTL with Insufficient Access Control
CVE-2025-47761
CWE-782 Low
No
No
7.2.10, 7.4.4 18.11.2025 SB2025111866
#VU117138 - Uncontrolled Search Path Element
CVE-2025-57716
CWE-427 Low
No
No
7.2.12, 7.4.4 14.10.2025 SB20251014109
#VU111049 - Improper Validation of Certificate with Host Mismatch
CVE-2024-54019
CWE-297 Medium
No
No
7.2.7, 7.4.1 11.06.2025 SB2025061114
#VU109046 - Exposure of Sensitive System Information to an Unauthorized Control Sphere
CVE-2025-24473
CWE-497 Low
No
No
7.2.2 13.05.2025 SB2025051367
#VU107370 - Use of Hard-coded Cryptographic Key
CVE-2024-50564
CWE-321 Low
No
No
7.4.1 10.04.2025 SB2025041044
#VU107308 - Improper Access Control
CVE-2024-40586
CWE-284 Low
No
No
7.0.14, 7.2.7, 7.4.1 09.04.2025 SB2025040973
#VU101831 - Cleartext Storage of Sensitive Information
CVE-2024-50570
CWE-312 Low
No
No
7.0.14, 7.2.7, 7.4.2 18.12.2024 SB2024121833
#VU100575 - Unprotected Storage of Credentials
CWE-256 High
No
Exploited
- 18.11.2024 SB2024111813
#VU100462 - Authentication Bypass Using an Alternate Path or Channel
CVE-2024-47574
CWE-288 Low
No
No
7.0.13, 7.2.5, 7.4.1 14.11.2024 SB2024111417
#VU100461 - Untrusted Search Path
CVE-2024-36507
CWE-426 Low
No
No
7.0.13, 7.2.5, 7.4.1 14.11.2024 SB2024111416
#VU100454 - Improper Privilege Management
CVE-2024-36513
CWE-269 Low
No
No
7.0.13, 7.2.5 14.11.2024 SB2024111411
#VU97117 - Improper Certificate Validation
CVE-2024-31489
CWE-295 Medium
No
No
7.0.12, 7.2.3 10.09.2024 SB20240910155
#VU97116 - Improper Certificate Validation
CVE-2022-45856
CWE-295 Medium
No
No
7.0.8 10.09.2024 SB20240910154
#VU91755 - Channel Accessible by Non-Endpoint ('Man-in-the-Middle')
CVE-2024-3661
CWE-300 Medium
No
No
- 11.06.2024 SB20240611271
SB2025011365
SB2025011657
and 7 more
#VU80637 - Heap-based Buffer Overflow
CVE-2023-4863
CWE-122 Critical
Available
Exploited
7.0.10, 7.2.3 11.09.2023 SB2023091178
SB2023091245
SB2023091265
and 137 more


Showing elements 1 - 20 out of 49