Forticlient (Fortinet) - vulnerabilities (CVEs)

85 CVEs, 0 in the last 30 days, 339 known versions, newest CVE from 2026-08-12. Vendor: Fortinet.

CVEs of Forticlient

CVE-2026-70465 - CVSS 8.1 (high), 2026-08-12: A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows…
CVE-2026-44278 - CVSS 5.5 (medium), 2026-05-12: A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.2, FortiClientWindows 7.2 all versions may allow attacker…
CVE-2026-24018 - CVSS 7.8 (high), 2026-03-10: A UNIX symbolic link (Symlink) following vulnerability in Fortinet FortiClientLinux 7.4.0 through 7.4.4, FortiClientLinux 7.2.2 through 7.2.12 may allow a…
CVE-2025-62676 - CVSS 7.1 (high), 2026-02-10: An Improper Link Resolution Before File Access ('Link Following') vulnerability [CWE-59] vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.4,…
CVE-2025-54660 - CVSS 5.5 (medium), 2025-11-18: An active debug code vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through 7.2.10, FortiClientWindows 7.0 all…
CVE-2025-47761 - CVSS 7.8 (high), 2025-11-18: An Exposed IOCTL with Insufficient Access Control vulnerability [CWE-782] vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows…
CVE-2025-46373 - CVSS 7.8 (high), 2025-11-18: A Heap-based Buffer Overflow vulnerability [CWE-122] vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through 7.2.8…
CVE-2025-57741 - CVSS 7.8 (high), 2025-10-14: An Incorrect Permission Assignment for Critical Resource vulnerability [CWE-732] in FortiClientMac 7.4.0 through 7.4.3, 7.2.0 through 7.2.11, 7.0 all versions…
CVE-2025-57716 - CVSS 7.3 (high), 2025-10-14: An Uncontrolled Search Path Element vulnerability [CWE-427] in FortiClient Windows 7.4.0 through 7.4.3, 7.2.0 through 7.2.11, 7.0 all versions may allow a…
CVE-2025-46774 - CVSS 7.8 (high), 2025-10-14: An Improper Verification of Cryptographic Signature vulnerability [CWE-347] in FortiClient MacOS installer version 7.4.2 and below, version 7.2.9 and below,…
CVE-2025-31365 - CVSS 7.1 (high), 2025-10-14: An Improper Control of Generation of Code ('Code Injection') vulnerability [CWE-94] in FortiClientMac 7.4.0 through 7.4.3, 7.2.1 through 7.2.8 may allow an…
CVE-2024-54019 - CVSS 6.5 (medium), 2025-06-10: A improper validation of certificate with host mismatch in Fortinet FortiClientWindows version 7.4.0, versions 7.2.0 through 7.2.6, and 7.0 all versions allow…
CVE-2025-25251 - CVSS 7.8 (high), 2025-05-28: An Incorrect Authorization vulnerability [CWE-863] in FortiClient Mac 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14 may allow a local…
CVE-2025-24473 - CVSS 4.8 (medium), 2025-05-28: A exposure of sensitive system information to an unauthorized control sphere vulnerability in Fortinet FortiClientWindows 7.2.0 through 7.2.1,…
CVE-2024-35281 - CVSS 7.8 (high), 2025-05-13: An improper isolation or compartmentalization vulnerability [CWE-653] in FortiClientMac version 7.4.2 and below, version 7.2.8 and below, 7.0 all versions and…
CVE-2023-45588 - CVSS 8.2 (high), 2025-03-14: An external control of file name or path vulnerability [CWE-73] in FortiClientMac version 7.2.3 and below, version 7.0.10 and below installer may allow a…
CVE-2024-52968 - CVSS 8.4 (high), 2025-02-11: An improper authentication in Fortinet FortiClientMac 7.0.11 through 7.2.4 allows attacker to gain improper access to MacOS via empty password.
CVE-2024-40586 - CVSS 6.7 (medium), 2025-02-11: An Improper Access Control vulnerability [CWE-284] in FortiClient Windows version 7.4.0, version 7.2.6 and below, version 7.0.13 and below may allow a local…
CVE-2024-50564 - CVSS 3.3 (low), 2025-01-14: A use of hard-coded cryptographic key in Fortinet FortiClientWindows version 7.4.0, 7.2.x all versions, 7.0.x all versions, and 6.4.x all versions may allow a…
CVE-2020-15934 - CVSS 8.8 (high), 2024-12-19: An execution with unnecessary privileges vulnerability in the VCM engine of FortiClient for Linux versions 6.2.7 and below, version 6.4.0. may allow local…
CVE-2024-50570 - CVSS 5 (medium), 2024-12-18: A Cleartext Storage of Sensitive Information vulnerability [CWE-312] in FortiClientWindows 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13 and…
CVE-2024-47574 - CVSS 7.8 (high), 2024-11-13: A authentication bypass using an alternate path or channel in Fortinet FortiClientWindows version 7.4.0, versions 7.2.4 through 7.2.0, versions 7.0.12 through…
CVE-2024-40592 - CVSS 7.5 (high), 2024-11-12: An improper verification of cryptographic signature vulnerability [CWE-347] in FortiClient MacOS version 7.4.0, version 7.2.4 and below, version 7.0.10 and…
CVE-2024-36513 - CVSS 8.8 (high), 2024-11-12: A privilege context switching error vulnerability [CWE-270] in FortiClient Windows version 7.2.4 and below, version 7.0.12 and below, 6.4 all versions may…
CVE-2024-36507 - CVSS 7.8 (high), 2024-11-12: A untrusted search path in Fortinet FortiClientWindows versions 7.4.0, versions 7.2.4 through 7.2.0, versions 7.0.12 through 7.0.0 allows an attacker to run…
CVE-2024-35282 - CVSS 4.6 (medium), 2024-09-10: A cleartext storage of sensitive information in memory vulnerability [CWE-316] affecting FortiClient VPN iOS 7.2 all versions, 7.0 all versions, 6.4 all…
CVE-2024-31489 - CVSS 8.1 (high), 2024-09-10: AAn improper certificate validation vulnerability [CWE-295] in FortiClientWindows 7.2.0 through 7.2.2, 7.0.0 through 7.0.11, FortiClientLinux 7.2.0, 7.0.0…
CVE-2022-45856 - CVSS 5.9 (medium), 2024-09-10: An improper certificate validation vulnerability [CWE-295] in FortiClientWindows 6.4 all versions, 7.0.0 through 7.0.7, FortiClientMac 6.4 all versions, 7.0…
CVE-2024-3661 - CVSS 7.6 (high), 2024-05-06: DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect…
CVE-2024-31492 - CVSS 8.2 (high), 2024-04-10: An external control of file name or path vulnerability [CWE-73] in FortiClientMac version 7.2.3 and below, version 7.0.10 and below installer may allow a…
CVE-2023-45590 - CVSS 9.6 (critical), 2024-04-09: An improper control of generation of code ('code injection') in Fortinet FortiClientLinux version 7.2.0, 7.0.6 through 7.0.10 and 7.0.3 through 7.0.4 allows…
CVE-2022-40681 - CVSS 7.1 (high), 2023-11-14: A incorrect authorization in Fortinet FortiClient (Windows) 7.0.0 - 7.0.7, 6.4.0 - 6.4.9, 6.2.0 - 6.2.9 and 6.0.0 - 6.0.10 allows an attacker to cause denial…
CVE-2023-41840 - CVSS 7.8 (high), 2023-11-14: A untrusted search path vulnerability in Fortinet FortiClientWindows 7.0.9 allows an attacker to perform a DLL Hijack attack via a malicious OpenSSL engine…
CVE-2023-33304 - CVSS 5.5 (medium), 2023-11-14: A use of hard-coded credentials vulnerability in Fortinet FortiClient Windows 7.0.0 - 7.0.9 and 7.2.0 - 7.2.1 allows an attacker to bypass system protections…
CVE-2023-37939 - CVSS 3.3 (low), 2023-10-10: An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClient for Windows 7.2.0, 7.0 all versions, 6.4 all versions,…
CVE-2022-33877 - CVSS 7 (high), 2023-06-13: An incorrect default permission [CWE-276] vulnerability in FortiClient (Windows) versions 7.0.0 through 7.0.6 and 6.4.0 through 6.4.8 and FortiConverter…
CVE-2023-22635 - CVSS 7.8 (high), 2023-04-11: A download of code without Integrity check vulnerability [CWE-494] in FortiClientMac version 7.0.0 through 7.0.7, 6.4 all versions, 6.2 all versions, 6.0 all…
CVE-2022-42470 - CVSS 7.8 (high), 2023-04-11: A relative path traversal vulnerability in Fortinet FortiClient (Windows) 7.0.0 - 7.0.7, 6.4.0 - 6.4.9, 6.2.0 - 6.2.9 and 6.0.0 - 6.0.10 allows an attacker to…
CVE-2022-40682 - CVSS 7.8 (high), 2023-04-11: A incorrect authorization in Fortinet FortiClient (Windows) 7.0.0 - 7.0.7, 6.4.0 - 6.4.9, 6.2.0 - 6.2.9 and 6.0.0 - 6.0.10 allows an attacker to execute…
CVE-2022-43946 - CVSS 8.1 (high), 2023-04-11: Multiple vulnerabilities including an incorrect permission assignment for critical resource [CWE-732] vulnerability and a time-of-check time-of-use (TOCTOU)…
CVE-2022-33878 - CVSS 5.5 (medium), 2022-11-02: An exposure of sensitive information to an unauthorized actor vulnerabiltiy [CWE-200] in FortiClient for Mac versions 7.0.0 through 7.0.5 may allow a local…
CVE-2022-26122 - CVSS 8.6 (high), 2022-11-02: An insufficient verification of data authenticity vulnerability [CWE-345] in FortiClient, FortiMail and FortiOS AV engines version 6.2.168 and below and…
CVE-2022-26113 - CVSS 7.7 (high), 2022-07-19: An execution with unnecessary privileges vulnerability [CWE-250] in FortiClientWindows 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2.0 through 6.2.9, 6.0.0…
CVE-2021-41031 - CVSS 7.8 (high), 2022-07-18: A relative path traversal vulnerability [CWE-23] in FortiClient for Windows versions 7.0.2 and prior, 6.4.6 and prior and 6.2.9 and below may allow a local…
CVE-2021-43066 - CVSS 8.4 (high), 2022-05-11: A external control of file name or path in Fortinet FortiClientWindows version 7.0.2 and below, version 6.4.6 and below, version 6.2.9 and below, version…
CVE-2021-44167 - CVSS 7.5 (high), 2022-05-11: An incorrect permission assignment for critical resource vulnerability [CWE-732] in FortiClient for Linux version 6.0.8 and below, 6.2.9 and below, 6.4.7 and…
CVE-2021-22127 - CVSS 8 (high), 2022-04-06: An improper input validation vulnerability in FortiClient for Linux 6.4.x before 6.4.3, FortiClient for Linux 6.2.x before 6.2.9 may allow an unauthenticated…
CVE-2021-44169 - CVSS 8.8 (high), 2022-04-06: A improper initialization in Fortinet FortiClient (Windows) version 6.0.10 and below, version 6.2.9 and below, version 6.4.7 and below, version 7.0.3 and…
CVE-2021-43205 - CVSS 5.3 (medium), 2022-04-06: An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClient for Linux version 7.0.2 and below, 6.4.7 and below and…
CVE-2021-41028 - CVSS 8.2 (high), 2021-12-16: A combination of a use of hard-coded cryptographic key vulnerability [CWE-321] in FortiClientEMS 7.0.1 and below, 6.4.6 and below and an improper certificate…
CVE-2021-36167 - CVSS 5.3 (medium), 2021-12-09: An improper authorization vulnerabiltiy [CWE-285] in FortiClient Windows versions 7.0.0 and 6.4.6 and below and 6.2.8 and below may allow an unauthenticated…
CVE-2021-43204 - CVSS 4.4 (medium), 2021-12-09: A improper control of a resource through its lifetime in Fortinet FortiClientWindows version 6.4.1 and 6.4.0, version 6.2.9 and below, version 6.0.10 and…
CVE-2021-32592 - CVSS 7.8 (high), 2021-12-01: An unsafe search path vulnerability in FortiClientWindows 7.0.0, 6.4.6 and below, 6.2.x, 6.0.x and FortiClientEMS 7.0.0, 6.4.6 and below, 6.2.x, 6.0.x may…
CVE-2021-42754 - CVSS 5 (medium), 2021-11-02: An improper control of generation of code vulnerability [CWE-94] in FortiClientMacOS versions 7.0.0 and below and 6.4.5 and below may allow an authenticated…
CVE-2021-36183 - CVSS 7.8 (high), 2021-11-02: An improper authorization vulnerability [CWE-285] in FortiClient for Windows versions 7.0.1 and below and 6.4.2 and below may allow a local unprivileged…
CVE-2021-26089 - CVSS 7.8 (high), 2021-07-12: An improper symlink following in FortiClient for Mac 6.4.3 and below may allow an non-privileged user to execute arbitrary privileged shell commands during…
CVE-2019-16150 - CVSS 5.5 (medium), 2020-06-04: Use of a hard-coded cryptographic key to encrypt security sensitive data in local storage and configuration in FortiClient for Windows prior to 6.4.0 may…
CVE-2020-9291 - CVSS 7.8 (high), 2020-06-01: An Insecure Temporary File vulnerability in FortiClient for Windows 6.2.1 and below may allow a local user to gain elevated privileges via exhausting the pool…
CVE-2020-9290 - CVSS 7.8 (high), 2020-03-15: A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable
CVE-2019-17658 - CVSS 9.8 (critical), 2020-03-12: An unquoted service path vulnerability in the FortiClient FortiTray component of FortiClientWindows v6.2.2 and prior allow an attacker to gain elevated…
CVE-2019-16155 - CVSS 7.1 (high), 2020-02-07: A privilege escalation vulnerability in FortiClient for Linux 6.2.1 and below may allow a user with low privilege to overwrite system files as root with…
CVE-2019-17652 - CVSS 6.5 (medium), 2020-02-06: A stack buffer overflow vulnerability in FortiClient for Linux 6.2.1 and below may allow a user with low privilege to cause FortiClient processes running…
CVE-2019-16152 - CVSS 6.5 (medium), 2020-02-06: A Denial of service (DoS) vulnerability in FortiClient for Linux 6.2.1 and below may allow an user with low privilege to cause FortiClient processes running…
CVE-2019-15711 - CVSS 7.8 (high), 2020-02-06: A privilege escalation vulnerability in FortiClient for Linux 6.2.1 and below may allow an user with low privilege to run system commands under root privilege…
CVE-2019-17650 - CVSS 7.8 (high), 2019-11-21: An Improper Neutralization of Special Elements used in a Command vulnerability in one of FortiClient for Mac OS root processes, may allow a local user of the…
CVE-2019-15704 - CVSS 5.5 (medium), 2019-11-21: A clear text storage of sensitive information vulnerability in FortiClient for Mac may allow a local attacker to read sensitive information logged in the…
CVE-2018-9195 - CVSS 5.9 (medium), 2019-11-21: Use of a hardcoded cryptographic key in the FortiGuard services communication protocol may allow a Man in the middle with knowledge of the key to eavesdrop on…
CVE-2019-6692 - CVSS 7.8 (high), 2019-10-24: A malicious DLL preload vulnerability in Fortinet FortiClient for Windows 6.2.0 and below allows a privileged attacker to perform arbitrary code execution via…
CVE-2018-9193 - CVSS 7.8 (high), 2019-05-30: A researcher has disclosed several vulnerabilities against FortiClient for Windows version 6.0.5 and below, version 5.6.6, the combination of these…
CVE-2018-9191 - CVSS 7.8 (high), 2019-05-30: A local privilege escalation in Fortinet FortiClient for Windows 6.0.4 and earlier allows attackers to execute unauthorized code or commands via the named…
CVE-2018-13368 - CVSS 7.8 (high), 2019-05-30: A local privilege escalation in Fortinet FortiClient for Windows 6.0.4 and earlier allows attacker to execute unauthorized code or commands via the command…
CVE-2019-5589 - CVSS 8.8 (high), 2019-05-28: A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable
CVE-2018-9190 - CVSS 5.5 (medium), 2019-02-08: A null pointer dereference vulnerability in Fortinet FortiClientWindows 6.0.2 and earlier allows attacker to cause a denial of service via the NDIS miniport…
CVE-2017-17543 - CVSS 7.5 (high), 2018-04-26: Users' VPN authentication credentials are unsafely encrypted in Fortinet FortiClient for Windows 5.6.0 and below versions, FortiClient for Mac OSX 5.6.0 and…
CVE-2017-14184 - CVSS 8.8 (high), 2017-12-15: An Information Disclosure vulnerability in Fortinet FortiClient for Windows 5.6.0 and below versions, FortiClient for Mac OSX 5.6.0 and below versions and…
CVE-2017-7344 - CVSS 8.1 (high), 2017-12-14: A privilege escalation in Fortinet FortiClient Windows 5.4.3 and earlier as well as 5.6.0 allows attacker to gain privilege via exploiting the Windows…
CVE-2016-8493 - CVSS 8.8 (high), 2017-06-26: In FortiClientWindows 5.4.1 and 5.4.2, an attacker may escalate privilege via a FortiClientNamedPipe vulnerability.
CVE-2015-7362 - CVSS 7.8 (high), 2016-01-08: Fortinet FortiClient Linux SSLVPN before build 2313, when installed on Linux in a home directory that is world readable and executable, allows local users to…
CVE-2015-5737 - CVSS 7.2 (high), 2015-09-03: The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, (4) mdare64_52.sys, and (5) Fortishield.sys drivers in Fortinet FortiClient before 5.2.4 do…
CVE-2015-5736 - CVSS 7.2 (high), 2015-09-03: The Fortishield.sys driver in Fortinet FortiClient before 5.2.4 allows local users to execute arbitrary code with kernel privileges by setting the callback…
CVE-2015-5735 - CVSS 7.2 (high), 2015-09-03: The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, and (4) mdare64_52.sys drivers in Fortinet FortiClient before 5.2.4 allow local users to write…
CVE-2015-4077 - CVSS 2.1 (low), 2015-09-03: The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, and (4) mdare64_52.sys drivers in Fortinet FortiClient before 5.2.4 allow local users to read…
CVE-2015-1570 - CVSS 4.3 (medium), 2015-02-10: The Endpoint Control protocol implementation in Fortinet FortiClient 5.2.3.091 for Android and 5.2.028 for iOS does not validate certificates, which makes it…
CVE-2015-1569 - CVSS 4.3 (medium), 2015-02-10: Fortinet FortiClient 5.2.028 for iOS does not validate certificates, which makes it easier for man-in-the-middle attackers to spoof SSL VPN servers via a…
CVE-2015-1453 - CVSS 5 (medium), 2015-02-02: The qm class in Fortinet FortiClient 5.2.3.091 for Android uses a hardcoded encryption key of FoRtInEt!AnDrOiD, which makes it easier for attackers to obtain…
CVE-2013-4669 - CVSS 5.4 (medium), 2013-06-25: FortiClient before 4.3.5.472 on Windows, before 4.0.3.134 on Mac OS X, and before 4.0 on Android; FortiClient Lite before 4.3.4.461 on Windows; FortiClient…
CVE-2009-1262 - CVSS 7.2 (high), 2009-04-07: Format string vulnerability in Fortinet FortiClient 3.0.614, and possibly earlier, allows local users to execute arbitrary code via format string specifiers…