Known vulnerabilities in FortiPAM

Vendor: Fortinet, Inc
Software: FortiPAM
Software CPE: cpe:2.3:a:fortinet:fortipam:*:*:*:*:*:*:*:*
Website: https://www.fortinet.com/
Total vulnerabilities: 27
Public exploits: 0
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.2

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting FortiPAM FortiPAM is affected by 27 known vulnerabilities: 3 high, 8 medium, 16 low Critical High Medium Low

Vulnerabilities (27)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU137528 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-59839		 CWE-22 Low
No
No
 1.7.3, 1.8.1 14.07.2026 SB2026071496
#VU137527 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-23573		 CWE-79 Medium
No
No
 1.8.1 14.07.2026 SB2026071494
#VU137525 - Stack-based buffer overflow
CVE-2026-59837		 CWE-121 Low
No
No
 1.8.3 14.07.2026 SB2026071492
#VU133362 - Resource exhaustion
CVE-2026-49975		 CWE-400 High
No
No
 1.9.2 04.06.2026 SB2026060491
SB2026060492
SB2026060493
and 30 more
#VU126001 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2025-61624		 CWE-22 High
No
Exploited
 1.7.1 14.04.2026 SB20260414125
#VU119482 - Information Exposure Through Log Files
CVE-2024-47570		 CWE-532 Low
No
No
 1.5.0 09.12.2025 SB2025120983
#VU118609 - Cleartext Storage of Sensitive Information in Memory
CVE-2025-61713		 CWE-316 Low
No
No
 1.6.1 18.11.2025 SB2025111878
#VU118604 - Improper Privilege Management
CVE-2025-54821		 CWE-269 Low
No
No
 1.6.1 18.11.2025 SB2025111873
#VU117215 - Weak Authentication
CVE-2025-49201		 CWE-1390 Medium
No
No
 1.4.3, 1.5.1 15.10.2025 SB2025101574
#VU117148 - Insertion of Sensitive Information Into Sent Data
CVE-2024-47569		 CWE-201 Low
No
No
 - 15.10.2025 SB2025101507
#VU117143 - Heap-based Buffer Overflow
CVE-2025-22258		 CWE-122 Low
No
No
 1.4.3, 1.5.1 15.10.2025 SB2025101503
#VU117136 - Heap-based Buffer Overflow
CVE-2025-57740		 CWE-122 Medium
No
No
 1.4.3, 1.5.1 14.10.2025 SB20251014108
#VU117130 - Improper Check or Handling of Exceptional Conditions
CVE-2024-26008		 CWE-703 Medium
No
No
 1.3.0 14.10.2025 SB20251014102
#VU113960 - Integer overflow
CVE-2025-25248		 CWE-190 Low
No
No
 1.4.3, 1.5.1 12.08.2025 SB2025081299
#VU113958 - Authentication Bypass Using an Alternate Path or Channel
CVE-2024-26009		 CWE-288 High
No
No
 - 12.08.2025 SB2025081297
#VU113906 - Double Free
CVE-2023-45584		 CWE-415 Low
No
No
 1.2.0 12.08.2025 SB2025081281
#VU111052 - Improper Handling of Insufficient Permissions or Privileges
CVE-2025-22256		 CWE-280 Low
No
No
 1.0.4, 1.1.3, 1.2.1, 1.3.1, 1.4.2 11.06.2025 SB2025061117
#VU105622 - Use of Externally-Controlled Format String
CVE-2024-45324		 CWE-134 Low
No
No
 1.3.2, 1.4.3 12.03.2025 SB2025031208
SB2025031209
SB2025031210
and 2 more
#VU103885 - Use of Externally-Controlled Format String
CVE-2023-40721		 CWE-134 Low
No
No
 1.2.0 12.02.2025 SB2025021205
SB2025021206
SB2025021207
and 1 more
#VU100401 - Improper Authentication
CVE-2024-26011		 CWE-287 Medium
No
No
 1.3.0 12.11.2024 SB20241112152
SB20241112154
SB20241112155
and 3 more


Showing elements 1 - 20 out of 27