The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
25 Jun 2025 Fortinet FortiOS Authentication bypass
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 16 Jul 2025
- Weakness
- CWE-798
18 Mar 2025 Fortinet FortiOS and FortiProxy Authentication bypass
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- fortinet fortiproxy 7.2.13, fortinet fortiproxy 7.0.20, fortinet fortios 7.0.17
- CISA due date
- 8 Apr 2025
- Weakness
- CWE-288
14 Jan 2025 Fortinet FortiOS and FortiProxy Authentication bypass
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- fortinet fortiproxy 7.2.13, fortinet fortiproxy 7.0.20, fortinet fortios 7.0.17
- CISA due date
- 21 Jan 2025
- Weakness
- CWE-288
25 Mar 2024 Fortinet FortiClient EMS SQL injection
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7.0.1 through 7.0.10 allows attacker to execute unauthorized code or commands via specially crafted packets.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- fortinet forticlient enterprise management server 7.2.3, fortinet forticlient enterprise management server 7.0.11
- CISA due date
- 15 Apr 2024
- Weakness
- CWE-89
9 Feb 2024 Fortinet FortiOS Memory corruption
A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.13, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, FortiOS 6.0 all versions, FortiProxy 7.4.0 through 7.4.2, FortiProxy 7.2.0 through 7.2.8, FortiProxy 7.0.0 through 7.0.14, FortiProxy 2.0.0 through 2.0.13, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiProxy 01.00 all versions allows attacker to execute unauthorized code or commands via specifically crafted requests
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- fortinet fortiproxy 7.4.3, fortinet fortios 7.4.3, fortinet fortiproxy 7.2.9, fortinet fortios 7.2.7, fortinet fortiproxy 7.0.15 and 5 older
- CISA due date
- 16 Feb 2024
- Weakness
- CWE-787
13 Jun 2023 Fortinet FortiOS and FortiProxy SSL-VPN Memory corruption
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 4 Jul 2023
- Weakness
- CWE-122
13 Dec 2022 Fortinet FortiOS Memory corruption
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- fortinet fortios 7.2.3, fortinet fortiproxy 7.2.2, fortinet fortios 7.0.9, fortinet fortiproxy 7.0.8, fortinet fortios 7.0.8 and 6 older
- CISA due date
- 3 Jan 2023
- Weakness
- CWE-197
11 Oct 2022 Fortinet Multiple Products Authentication bypass
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- fortinet fortios 7.2.2, fortinet fortiproxy 7.0.7, fortinet fortios 7.0.7
- CISA due date
- 1 Nov 2022
- Weakness
- CWE-288
8 Sep 2022 Fortinet FortiOS and FortiADC Access control flaw
A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connectivity test request to a rogue LDAP server instead of the configured one.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- fortinet fortios 6.0.3, fortinet fortiadc 6.0.2, fortinet fortiadc 5.4.5
- CISA due date
- 29 Sep 2022
- Weakness
- CWE-732
10 Jan 2022 Fortinet FortiOS and FortiProxy Memory corruption
A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle javascript href data when proxying webpages.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- fortinet fortios 6.0.5, fortinet fortios 5.6.11, fortinet fortios 5.4.13, fortinet fortios 5.2.15, fortinet fortiproxy 1.2.9
- CISA due date
- 10 Jul 2022
- Weakness
- CWE-787
10 Jan 2022 Fortinet FortiOS and FortiProxy Access control flaw
An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- fortinet fortios 6.0.5, fortinet fortios 5.6.9, fortinet fortios 5.4.11, fortinet fortiproxy 1.2.9
- CISA due date
- 10 Jul 2022
- Weakness
- CWE-285
3 Nov 2021 Fortinet FortiOS Authentication bypass
An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if they changed the case of their username.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- fortinet fortios 6.2.4, fortinet fortios 6.0.10
- CISA due date
- 3 May 2022
- Weakness
- CWE-178, CWE-287
3 Nov 2021 Fortinet FortiOS Authentication bypass
A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-306
3 Nov 2021 Fortinet FortiOS Path traversal
An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- fortinet fortios 6.0.5, fortinet fortios 5.6.8, fortinet fortios 5.4.13, fortinet fortiproxy 1.2.9
- CISA due date
- 3 May 2022
- Weakness
- CWE-22
On Hacker News
CVE-2018-13379 exploited in the wildKnow when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.