Fortinet Fortiadc

FortiADC 8.0.0/7.6.x XSS via Script Tag Injection URL
CVE-2025-58412 4.2 - Medium - November 19, 2025

A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiADC 8.0.0, FortiADC 7.6.0 through 7.6.3, FortiADC 7.4 all versions, FortiADC 7.2 all versions may allow attacker to execute unauthorized code or commands via crafted URL.

Basic XSS

FortiADC 6-8 OOB Write CVE-2025-48839 (HTTP RQ)
CVE-2025-48839 6.3 - Medium - November 18, 2025

An Out-of-bounds Write vulnerability [CWE-787] in FortiADC 8.0.0, 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, 7.2 all versions, 7.1 all versions, 7.0 all versions, 6.2 all versions may allow an authenticated attacker to execute arbitrary code via specially crafted HTTP requests.

Memory Corruption

Exposure of Sensitive Info via Logs in FortiADC 7.4.0 & older (7.2,7.1,7.0,6.2)
CVE-2025-54971 3.9 - Low - November 18, 2025

An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiADC 7.4.0, FortiADC 7.2 all versions, FortiADC 7.1 all versions, FortiADC 7.0 all versions, FortiADC 6.2 all versions may allow an admin with read-only permission to get the external resources password via the logs of the product

Information Disclosure

Sensitive Data Exposure via HTTP in FortiADC 7.4.0-7.0 (CWE-200)
CVE-2025-59921 6.2 - Medium - October 14, 2025

An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in Fortinet FortiADC version 7.4.0, version 7.2.3 and below, version 7.1.4 and below, 7.0 all versions, 6.2 all versions may allow an authenticated attacker to obtain sensitive data via crafted HTTP or HTTPs requests.

Information Disclosure

FortiADC 7.2.x OS Command Injection (CWE-78) before 7.1.1
CVE-2025-49813 - August 12, 2025

An improper neutralization of special elements used in an OS Command ("OS Command Injection") vulnerability [CWE-78] in Fortinet FortiADC version 7.2.0 and before 7.1.1 allows a remote and authenticated attacker with low privilege to execute unauthorized code via specifically crafted HTTP parameters.

Shell injection

FortiADC 7.6.0-7.6.1 OS Command Injection via HTTP
CVE-2025-31104 - June 10, 2025

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiADC 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, 7.2.0 through 7.2.7, 7.1.0 through 7.1.4, 7.0 all versions, 6.2 all versions, 6.1 all versions may allow an authenticated attacker to execute unauthorized code via crafted HTTP requests.

Shell injection

FortiADC GUI XSS (CWE-79) v7.2.0-7.2.1, 7.4.0 (before 7.1.3)
CVE-2023-37933 6.1 - Medium - March 11, 2025

An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiADC GUI version 7.4.0, 7.2.0 through 7.2.1 and before 7.1.3 allows an authenticated attacker to perform an XSS attack via crafted HTTP or HTTPs requests.

XSS

Fortinet FortiManager/<others> <=7.4.3 Cache Poison via External Host Header
CVE-2022-23439 4.1 - Medium - January 22, 2025

A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafted HTTP requests, where the `Host` header points to an arbitrary webserver

Externally Controlled Reference to a Resource in Another Sphere

FortiADC WAF Cookie Encryption Bypass (Vulnerable <7.4.5)
CVE-2024-36511 3.7 - Low - September 10, 2024

An improperly implemented security check for standard vulnerability [CWE-358] in FortiADC Web Application Firewall (WAF) 7.4.0 through 7.4.4, 7.2 all versions, 7.1 all versions, 7.0 all versions, 6.2 all versions, 6.1 all versions, 6.0 all versions when cookie security policy is enabled may allow an attacker, under specific conditions, to retrieve the initial encrypted and signed cookie protected by the feature

Improperly Implemented Security Check for Standard

FortiADC 7.4.0-7.4.1 Improper Access Control Enables Write by Authenticated Read-Only User
CVE-2023-50181 6.5 - Medium - July 09, 2024

An improper access control vulnerability [CWE-284] in Fortinet FortiADC version 7.4.0 through 7.4.1 and before 7.2.4 allows a read only authenticated attacker to perform some write actions via crafted HTTP or HTTPS requests.

FortiADC 7.x Improper Cert Validation (CVE-2023-50179) MITM Risk
CVE-2023-50179 5.9 - Medium - July 09, 2024

An improper certificate validation vulnerability [CWE-295] in FortiADC 7.4.0, 7.2 all versions, 7.1 all versions, 7.0 all versions may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the device and public SDN connectors.

Improper Certificate Validation

CVE-2023-50178: MitM via Improper Cert Validation in FortiADC 7.4.0-7.2.3
CVE-2023-50178 7.4 - High - July 09, 2024

An improper certificate validation vulnerability [CWE-295] in FortiADC 7.4.0, 7.2.0 through 7.2.3, 7.1 all versions, 7.0 all versions, 6.2 all versions, 6.1 all versions and 6.0 all versions may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the device and various remote servers such as private SDN connectors and FortiToken Cloud.

Improper Certificate Validation

FortiADC 7.4.1 and Earlier Admin Data Exposure (CWE-497)
CVE-2023-50180 5.5 - Medium - May 14, 2024

An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiADC version 7.4.1 and below, version 7.2.3 and below, version 7.1.4 and below, version 7.0.5 and below, version 6.2.6 and below may allow a read-only admin to view data pertaining to other admins.

Exposure of Sensitive System Information to an Unauthorized Control Sphere

FortiADC 7.4.0 / <7.2.2 Improper Auth: Low-Privileged Read of Full Config
CVE-2023-41673 5.4 - Medium - December 13, 2023

An improper authorization vulnerability [CWE-285] in Fortinet FortiADC version 7.4.0 and before 7.2.2 may allow a low privileged user to read or backup the full system configuration via HTTP or HTTPS requests.

AuthZ

FortiADC & FortiDDoS-F buffer overflow via CLI (7.2.0/7.1.2,6.5.0/6.4.1)
CVE-2023-29177 6.7 - Medium - November 14, 2023

Multiple buffer copy without checking size of input ('classic buffer overflow') vulnerabilities [CWE-120] in FortiADC version 7.2.0 and before 7.1.2 & FortiDDoS-F version 6.5.0 and before 6.4.1 allows a privileged attacker to execute arbitrary code or commands via specifically crafted CLI requests.

FortiADC / FortiDDoS Cross-domain Policy Bypass 7.1.x/6.3-6.4
CVE-2023-25603 9.1 - Critical - November 14, 2023

A permissive cross-domain policy with untrusted domains vulnerability in Fortinet FortiADC 7.1.0 - 7.1.1, FortiDDoS-F 6.3.0 - 6.3.4 and 6.4.0 - 6.4.1 allow an unauthorized attacker to carry out privileged actions and retrieve sensitive information via crafted web requests.

FortiADC Automate CLI PrivEsc v7.1.0-7.1.2 & v6.x
CVE-2023-26205 7.9 - High - November 14, 2023

An improper access control vulnerability [CWE-284] in FortiADC automation feature 7.1.0 through 7.1.2, 7.0 all versions, 6.2 all versions, 6.1 all versions may allow an authenticated low-privileged attacker to escalate their privileges to super_admin via a specific crafted configuration of fabric automation CLI script.

Authorization

OS Command Injection via wordexp in Fortinet Forti* mgmt interface
CVE-2023-25607 7.4 - High - October 10, 2023

An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78 ] in FortiManager 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions, FortiAnalyzer 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions and FortiADC  7.1.0, 7.0.0 through 7.0.3, 6.2 all versions, 6.1 all versions, 6.0 all versions management interface may allow an authenticated attacker with at least READ permissions on system settings to execute arbitrary commands on the underlying shell due to an unsafe usage of the wordexp function.

Shell injection

FortiADC OS Command Injection (CWE-78) 7.1.1
CVE-2022-35849 7.4 - High - September 13, 2023

An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiADC 7.1.0 through 7.1.1, 7.0.0 through 7.0.3, 6.2.0 through 6.2.5 and 6.1.0 all versions may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands.

Shell injection

CVE-2023-26210: FortiADC/Manager 7.2.0/7.1.2 OS Command Injection via CLI
CVE-2023-26210 7.8 - High - June 13, 2023

Multiple improper neutralization of special elements used in an os command ('OS Command Injection') vulnerabilties [CWE-78] vulnerability in Fortinet allows a local authenticated attacker to execute arbitrary shell code as `root` user via crafted CLI requests.

Shell injection

FortiADC CLI OS Command Injection via diagnose system df (pre-7.1.0)
CVE-2023-28000 7.8 - High - June 13, 2023

An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC CLI 7.1.0, 7.0.0 through 7.0.3, 6.2.0 through 6.2.4, 6.1 all versions, 6.0 all versions may allow a local and authenticated attacker to execute unauthorized commands via specifically crafted arguments in diagnose system df CLI command.

Shell injection

FortiADC 7.2.0 & Before 7.1.1 Rel Path Traversal Deletes Directories
CVE-2023-27993 7.1 - High - May 03, 2023

A relative path traversal [CWE-23] in Fortinet FortiADC version 7.2.0 and before 7.1.1 allows a privileged attacker to delete arbitrary directories from the underlying file system via crafted CLI commands.

Directory traversal

FortiADC 7.2.0-7.1.1 CMD Injection via OS Command CWE-78
CVE-2023-27999 7.8 - High - May 03, 2023

An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC 7.2.0, 7.1.0 through 7.1.1 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands.

Shell injection

FortiADC OS Command Injection via Unsanitized Args (CVE-2022-40679)
CVE-2022-40679 7.8 - High - April 11, 2023

An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC 5.x all versions, 6.0 all versions, 6.1 all versions, 6.2.0 through 6.2.4, 7.0.0 through 7.0.3, 7.1.0; FortiDDoS 4.x all versions, 5.0 all versions, 5.1 all versions, 5.2 all versions, 5.3 all versions, 5.4 all versions, 5.5 all versions, 5.6 all versions and FortiDDoS-F 6.4.0, 6.3.0 through 6.3.3, 6.2.0 through 6.2.2, 6.1.0 through 6.1.4 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands.

Shell injection

Fortinet FortiWeb/ADC OS Command Injection in v7.0-7.1.1
CVE-2022-43948 7.8 - High - April 11, 2023

A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 7.0.0 through 7.0.3, FortiADC version 7.1.0 through 7.1.1, FortiADC version 7.0.0 through 7.0.3, FortiADC 6.2 all versions, FortiADC 6.1 all versions, FortiADC 6.0 all versions, FortiADC 5.4 all versions, FortiADC 5.3 all versions, FortiADC 5.2 all versions, FortiADC 5.1 all versions allows attacker to execute unauthorized code or commands via specifically crafted arguments to existing commands.

Shell injection

FortiADC XSS (v<=7.1.1) via crafted HTTP requests
CVE-2022-43952 5.4 - Medium - April 11, 2023

An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiADC version 7.1.1 and below, version 7.0.3 and below, version 6.2.5 and below may allow an authenticated attacker to perform a cross-site scripting attack via crafted HTTP requests.

XSS

Fortinet FortiADC 5.x.x-7.0.1 OS Command Injection via CLI
CVE-2022-27482 7.8 - High - February 16, 2023

A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiADC version 7.0.0 through 7.0.1, 6.2.0 through 6.2.2, 6.1.0 through 6.1.6, 6.0.x, 5.x.x allows attacker to execute arbitrary shell code as `root` via CLI commands.

Shell injection

FortiADC OS Command Injection 7.0.2 (v5.4-7.0)
CVE-2022-39947 8.8 - High - January 03, 2023

A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiADC version 7.0.0 through 7.0.2, FortiADC version 6.2.0 through 6.2.3, FortiADC version version 6.1.0 through 6.1.6, FortiADC version 6.0.0 through 6.0.4, FortiADC version 5.4.0 through 5.4.5 may allow an attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

Shell injection

FortiADC 6.2.47.1.0: Improper Validation Allows Auth File Retrieval
CVE-2022-33876 6.5 - Medium - December 06, 2022

Multiple instances of improper input validation vulnerability in Fortinet FortiADC version 7.1.0, version 7.0.0 through 7.0.2 and version 6.2.4 and below allows an authenticated attacker to retrieve files with specific extension from the underlying Linux system via crafted HTTP requests.

Improper Input Validation

SQLi in FortiADC 7.1.0 (incl. 7.0.07.0.2, 6.2.4) via HTTP Authenticated
CVE-2022-33875 8.8 - High - December 06, 2022

An improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability in Fortinet FortiADC version 7.1.0, version 7.0.0 through 7.0.2 and version 6.2.4 and below allows an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

SQL Injection

FortiADC 5.0-7.0.2 WAF Bypass via Malformed HTTP Request (CWE-228)
CVE-2022-38381 9.8 - Critical - November 02, 2022

An improper handling of malformed request vulnerability [CWE-228] exists in FortiADC 5.0 all versions, 6.0.0 all versions, 6.1.0 all versions, 6.2.0 through 6.2.3, and 7.0.0 through 7.0.2. This may allow a remote attacker without privileges to bypass some Web Application Firewall (WAF) protection such as the SQL Injection and XSS filters via a malformed HTTP request.

FortiADC 7.1.0 XSS via IP config in mgmt interface
CVE-2022-35851 5.4 - Medium - November 02, 2022

An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiADC management interface 7.1.0 may allow a remote and authenticated attacker to trigger a stored cross site scripting (XSS) attack via configuring a specially crafted IP Address.

XSS

FortiADC 7.0.0-7.0.2 and 6.2.0-6.2.4 XSS via URL/User fields in web page gen
CVE-2022-38374 6.1 - Medium - November 02, 2022

A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiADC 7.0.0 - 7.0.2 and 6.2.0 - 6.2.4 allows an attacker to execute unauthorized code or commands via the URL and User fields observed in the traffic and event logviews.

XSS

FortiADC Privilege Escalation via Shell (v6.2.1 & below)
CVE-2021-43076 6.5 - Medium - September 06, 2022

An improper privilege management vulnerability [CWE-269] in FortiADC versions 6.2.1 and below, 6.1.5 and below, 6.0.4 and below, 5.4.5 and below and 5.3.7 and below may allow a remote authenticated attacker with restricted user profile to modify the system files using the shell access.

Improper Privilege Management

Forti Products Format String via CmdLine 6.0.0-7.0.2 Allow Exec
CVE-2022-22299 7.8 - High - August 05, 2022

A format string vulnerability [CWE-134] in the command line interpreter of FortiADC version 6.0.0 through 6.0.4, FortiADC version 6.1.0 through 6.1.5, FortiADC version 6.2.0 through 6.2.1, FortiProxy version 1.0.0 through 1.0.7, FortiProxy version 1.1.0 through 1.1.6, FortiProxy version 1.2.0 through 1.2.13, FortiProxy version 2.0.0 through 2.0.7, FortiProxy version 7.0.0 through 7.0.1, FortiOS version 6.0.0 through 6.0.14, FortiOS version 6.2.0 through 6.2.10, FortiOS version 6.4.0 through 6.4.8, FortiOS version 7.0.0 through 7.0.2, FortiMail version 6.4.0 through 6.4.5, FortiMail version 7.0.0 through 7.0.2 may allow an authenticated user to execute unauthorized code or commands via specially crafted command arguments.

Use of Externally-Controlled Format String

FortiADC 6.2.x Auth Bypass in Password Change via Unverified Old Password
CVE-2022-27484 4.3 - Medium - August 03, 2022

A unverified password change in Fortinet FortiADC version 6.2.0 through 6.2.3, 6.1.x, 6.0.x, 5.x.x allows an authenticated attacker to bypass the Old Password check in the password change form via a crafted HTTP request.

authentification

Multiple improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerabilities [CWE-89] in FortiADC management interface 7.0.0 through 7.0.1, 5.0.0 through 6.2.2 may
CVE-2022-26120 8.8 - High - July 18, 2022

Multiple improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerabilities [CWE-89] in FortiADC management interface 7.0.0 through 7.0.1, 5.0.0 through 6.2.2 may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

SQL Injection

Multiple stack-based buffer overflows in the command line interpreter of FortiWeb before 6.4.2 may
CVE-2021-36193 6.3 - Medium - February 02, 2022

Multiple stack-based buffer overflows in the command line interpreter of FortiWeb before 6.4.2 may allow an authenticated attacker to achieve arbitrary code execution via specially crafted commands.

Stack Overflow

A missing cryptographic steps vulnerability in the function
CVE-2021-32591 5.3 - Medium - December 08, 2021

A missing cryptographic steps vulnerability in the function that encrypts users' LDAP and RADIUS credentials in FortiSandbox before 4.0.1, FortiWeb before 6.3.12, FortiADC before 6.2.1, FortiMail 7.0.1 and earlier may allow an attacker in possession of the password store to compromise the confidentiality of the encrypted secrets.

A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may
CVE-2021-42757 6.3 - Medium - December 08, 2021

A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to achieve arbitrary code execution via specially crafted command line arguments.

Classic Buffer Overflow

A cleartext storage of sensitive information in GUI in FortiADC versions 5.4.3 and below, 6.0.0 and below may
CVE-2020-15935 4.3 - Medium - November 02, 2021

A cleartext storage of sensitive information in GUI in FortiADC versions 5.4.3 and below, 6.0.0 and below may allow a remote authenticated attacker to retrieve some sensitive information such as users LDAP passwords and RADIUS shared secret by deobfuscating the passwords entry fields.

Cleartext Storage of Sensitive Information

A clear text storage of sensitive information into log file vulnerability in FortiADCManager 5.3.0 and below, 5.2.1 and below and FortiADC 5.3.7 and below may
CVE-2021-24024 6.5 - Medium - April 12, 2021

A clear text storage of sensitive information into log file vulnerability in FortiADCManager 5.3.0 and below, 5.2.1 and below and FortiADC 5.3.7 and below may allow a remote authenticated attacker to read other local users' password in log files.

Insertion of Sensitive Information into Log File

An improper neutralization of input vulnerability in Fortinet FortiADC 5.3.3 and earlier may
CVE-2019-6699 5.4 - Medium - March 13, 2020

An improper neutralization of input vulnerability in Fortinet FortiADC 5.3.3 and earlier may allow an attacker to execute a stored Cross Site Scripting (XSS) via a field in the traffic group interface.

XSS

A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4
CVE-2018-13374 4.3 - Medium - January 22, 2019

A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connectivity test request to a rogue LDAP server instead of the configured one.

Incorrect Permission Assignment for Critical Resource