Known vulnerabilities in FortiSwitch Manager

Known vulnerabilities in FortiSwitch Manager

Vendor: Fortinet, Inc

Software: FortiSwitch Manager

Software CPE: cpe:2.3:a:fortinet:fortiswitch_manager:*:*:*:*:*:*:*:*

Website: https://www.fortinet.com/

Total vulnerabilities: 19

Public exploits: 4

Known exploited (KEV): 5

Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Vulnerabilities (19)

Vulnerability	CWE-ID	CSH Severity	Public Exploit	KEV	First fixed release	Published	Bulletins
#VU126001 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVE-2025-61624	CWE-22	High	No	Exploited	7.0.7, 7.2.8	14.04.2026	SB20260414125
#VU121971 - Improper Verification of Cryptographic Signature CVE-2026-24858	CWE-347	Critical	Available	Exploited	7.0.16, 7.2.13, 7.4.10, 7.6.6	23.01.2026	SB2026012392
#VU121226 - Heap-based Buffer Overflow CVE-2025-25249	CWE-122	Critical	No	No	7.0.6, 7.2.7	13.01.2026	SB2026011365
#VU119696 - Improper Verification of Cryptographic Signature CVE-2025-59719	CWE-347	Critical	Available	Exploited	7.0.6, 7.2.7	10.12.2025	SB2025121064
#VU119694 - Improper Verification of Cryptographic Signature CVE-2025-59718	CWE-347	Critical	Available	Exploited	7.0.6, 7.2.7	10.12.2025	SB2025121064
#VU117215 - Weak Authentication CVE-2025-49201	CWE-1390	Medium	No	No	7.2.5	15.10.2025	SB2025101574
#VU117143 - Heap-based Buffer Overflow CVE-2025-22258	CWE-122	Low	No	No	7.2.6	15.10.2025	SB2025101503
#VU117130 - Improper Check or Handling of Exceptional Conditions CVE-2024-26008	CWE-703	Medium	No	No	7.0.4, 7.2.4	14.10.2025	SB20251014102
#VU113958 - Authentication Bypass Using an Alternate Path or Channel CVE-2024-26009	CWE-288	High	No	No	7.0.4, 7.2.4	12.08.2025	SB2025081297
#VU109045 - Missing Authentication for Critical Function CVE-2025-22252	CWE-306	High	No	No	7.2.6	13.05.2025	SB2025051366
#VU103885 - Use of Externally-Controlled Format String CVE-2023-40721	CWE-134	Low	No	No	7.0.3, 7.2.3	12.02.2025	SB2025021205 SB2025021206 SB2025021207 and 1 more
#VU100401 - Improper Authentication CVE-2024-26011	CWE-287	Medium	No	No	7.0.4, 7.2.4	12.11.2024	SB20241112152 SB20241112154 SB20241112155 and 3 more
#VU96013 - Insufficient Session Expiration CVE-2022-45862	CWE-613	Low	No	No	7.2.2	14.08.2024	SB2024081474
#VU91760 - Stack-based buffer overflow CVE-2024-26010	CWE-121	Medium	No	No	7.0.4, 7.2.4	11.06.2024	SB20240611274
#VU89658 - Use of Externally-Controlled Format String CVE-2023-45583	CWE-134	Low	No	No	7.0.3, 7.2.3	20.05.2024	SB2024052014
#VU89656 - Use of Externally-Controlled Format String CVE-2023-36640	CWE-134	Low	No	No	7.0.3, 7.2.3	20.05.2024	SB2024052014
#VU77961 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVE-2022-42474	CWE-22	Low	No	No	7.0.2, 7.2.2	05.07.2023	SB2023070507 SB2024031818
#VU72345 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVE-2022-41335	CWE-22	Medium	No	No	7.0.1, 7.2.1	17.02.2023	SB2023021709 SB2023021711 SB2023021712
#VU68070 - Authentication Bypass Using an Alternate Path or Channel CVE-2022-40684	CWE-288	Critical	Available	Exploited	7.2.1	08.10.2022	SB2022100806 SB2022101028