Fortinet security advisories, February 2026

Every Fortinet security advisory published in February 2026, from FortiGuard PSIRT Advisories, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 9
Critical: 1
High: 4
In CISA KEV: 2
CVEs: 9

Fortinet advisories published in February 2026

Feb 10, 2026
High [CVE-2026-21743] missing authorization vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions…
High7.2
Feb 10, 2026
High [CVE-2025-62676] FortiClient: Improper Link Resolution Before File Access ('Link Following') vulnerability [CWE-59] vulnerability in Fortinet…
High7.1
Feb 10, 2026
High [CVE-2025-52436] FortiSandbox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in…
High8.8
Feb 10, 2026
High [CVE-2026-22153] LDAP authentication bypass in Agentless VPN and FSSO
High8.1
Feb 10, 2026
Medium [CVE-2025-68686] Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0…
Medium5.9ExploitedCISA KEV
Feb 10, 2026
Medium [CVE-2025-64157] use of externally-controlled format string vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9…
Medium6.7
Feb 10, 2026
Medium [CVE-2025-62439] Improper Verification of Source of a Communication Channel vulnerability [CWE-940] vulnerability in Fortinet FortiOS 7.6.0…
Medium4.2
Feb 10, 2026
Medium [CVE-2025-55018] inconsistent interpretation of http requests ('http request smuggling') vulnerability in Fortinet FortiOS 7.6.0, FortiOS…
Medium5.8
Feb 6, 2026
Critical [CVE-2026-21643] improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS…
Critical9.8ExploitedCISA KEV

Get an email when Fortinet publishes the next one.

See Fortinet's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Fortinet

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.