Fortinet FortiOS SSL VPN flaws have appeared in CISA's exploited vulnerability list repeatedly since 2021, from a 2018 path traversal to 2022 and 2023 memory bugs. The pattern defenders should act on is simple: internet-facing VPN code is attacked within days, so exposure, patch speed and off-box logging matter more than any single CVE.
What does the record show?
This is a pattern post, not a story about one breach. Every item below comes from CISA or Fortinet's own advisory.
- CVE-2018-13379: a FortiOS SSL VPN path traversal that lets an unauthenticated attacker read system files, including a session file that can hold clear-text credentials. CISA's AA21-209A named it among routinely exploited vulnerabilities, last revised 20 August 2021. It was added to CISA's KEV catalog on 3 November 2021.
- CVE-2019-5591 and CVE-2020-12812: also named in AA21-209A as exploited in 2021, and added to KEV the same day in November 2021.
- CVE-2022-42475: a heap-based buffer overflow in FortiOS SSL VPN. Fortinet published its advisory on 12 December 2022, scored it 9.8, and wrote that it was aware of an instance exploited in the wild. KEV added it on 13 December 2022. The vendor's workaround was to disable SSL VPN.
- CVE-2023-27997: FortiOS and FortiProxy SSL VPN, added to KEV on 13 June 2023.
- CVE-2024-21762: FortiOS, added on 9 February 2024.
- CVE-2024-55591 and CVE-2025-24472: FortiOS and FortiProxy, added on 14 January 2025 and 18 March 2025, both flagged by CISA as used in ransomware campaigns.
In the 16 October 2026 KEV feed, 32 entries list Fortinet as the vendor and 14 carry the ransomware-use flag. Nine were added in 2026 alone.
Why does the same product category keep showing up?
SSL VPN services sit on the internet, parse untrusted input before authentication, and run with high privilege. That mix gives attackers an unauthenticated path to a trusted network. Fortinet's own CVE-2022-42475 advisory shows the shape: a remote, unauthenticated attacker, specially crafted requests, code execution.
It is not unique to one vendor. The same CISA data shows Ivanti, Cisco and others in the same position. Fortinet is the case here because the record is long and well documented.
What did the advisories ask defenders to do?
CISA's AA21-209A recommends patching promptly with internet-facing systems first, enabling automatic updates where possible, requiring multi-factor authentication for remote access, and monitoring for unscheduled tasks, unknown files and traversal attempts against the session file path. Fortinet's advisory for CVE-2022-42475 tells customers to check against published indicators of compromise.
What to do
- List every FortiOS and FortiProxy instance with its version, and note which expose SSL VPN to the internet.
- Compare versions with the fixed releases in the vendor advisory, not with a vulnerability score alone.
- Treat a KEV addition as a clock. Decide your own number of days and write it in policy.
- Reduce exposure. If SSL VPN is not needed on a given device, disable it, as the vendor's workaround says for CVE-2022-42475.
- Ship logs to a separate system and alert on new admin accounts, new scheduled tasks and unexpected configuration changes.
- After a vulnerable window, hunt. Patching does not remove an attacker who got in earlier. Rotate credentials that passed through the device.
- Require MFA on remote access so a stolen password alone is not enough.
Quick check
Is a patched Fortinet device safe from earlier compromise?
Not automatically. A patch closes the hole but does not remove access an attacker already gained. Check indicators in the vendor advisory and rotate credentials.
Where can I see which Fortinet flaws are known to be exploited?
CISA's Known Exploited Vulnerabilities catalog lists them with added dates and a ransomware-use field, and offers CSV and JSON downloads.
Sources
- CISA advisory AA21-209A
- Fortinet PSIRT FG-IR-22-398 (CVE-2022-42475)
- CISA Known Exploited Vulnerabilities catalog and JSON feed (version 2026.10.16, fetched 18 October 2026)
Last reviewed: 18 October 2026.
