Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
A stack-based overflow vulnerability [CWE-124] in Fortinet FortiOS version 7.0.0 through 7.0.10 and 7.2.0 through 7.2.3 and FortiProxy version 7.0.0 through 7.0.9 and 7.2.0 through 7.2.2 allows a remote unauthenticated attacker to execute arbitrary code or command via crafted packets reaching proxy policies or firewall policies with proxy mode alongside deep or full packet inspection.
Priority
HIGH
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
3 versions affected across 2 products
| Date | Total | Labels |
|---|
| 2026-04-21 | 2 | Active Exploitation1Patch1 |
| 2026-04-22 | 1 | General1 |
Top 5 Trending CVEs: 1 - CVE-2023-33308 2 - CVE-2022-42475 3 - CVE-2026-32201 4 - CVE-2026-33827 5 - CVE-2024-3721 #cve #cvetrends #cveshield #cybersecurity https://www.cveshield.com/dashboard
Post summary
The post merely lists trending CVEs without providing any supporting technical information, exploitation details, or mitigation guidance.
Fortinet has patched numerous critical RCE vulns in the past 5 years across FortiOS, FortiProxy, FortiClient EMS, FortiSandbox, etc. Many were unauthenticated/high-severity and some exploited in the wild. Notable ones: - CVE-2023-33308 (FortiOS/FortiProxy, CVSS 9.8 buffer overflow) - CVE-2024-21762 (FortiOS SSL VPN RCE, wild exploitation) - CVE-2026-35616 (FortiClient EMS zero-day unauth RCE) - CVE-2026-39808 & CVE-2026-39813 (FortiSandbox unauth RCE, public PoC) Patches exist, but the frequency in perimeter products is why some avoid them.
Post summary
Fortinet has patched a series of high‑severity RCE vulnerabilities, several with known PoC code and wild exploitation, and the text confirms both the availability of patches and the nature of the attacks.
**Here's the thorough list of major Fortinet RCE vulns (2021-Apr 2026), focused on critical/unauth ones in perimeter products. EIT = exploited in the wild (CISA KEV + vendor reports).** - **2022**: CVE-2022-42475 (FortiOS SSL VPN RCE, EIT by China actors) - **2023**: CVE-2023-27997 (FortiGate VPN heap overflow RCE, EIT); CVE-2023-33308 (FortiOS/FortiProxy buffer overflow RCE) - **2024**: CVE-2024-21762 (FortiOS SSLVPN RCE, EIT); CVE-2024-23113 (FortiOS/FortiProxy RCE, EIT) - **2025**: CVE-2025-25257 (FortiWeb pre-auth SQLi→RCE, EIT); CVE-2025-32756 (multi-product buffer overflow RCE, EIT); CVE-2025-58034 (FortiWeb cmd injection RCE, EIT) - **2026**: CVE-2026-21643 (FortiClient EMS SQLi RCE, EIT); CVE-2026-35616 (FortiClient EMS unauth RCE, EIT); CVE-2026-39808/39813 (FortiSandbox unauth RCE) Patches released for all; frequency in exposed devices drives the risk.
Post summary
The post enumerates multiple Fortinet RCE CVEs, noting each has been actively exploited in the wild, while also confirming available patches for all affected products.
5 of 5 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | fortinet | fortios | - | - | - |
| App | fortinet | fortiproxy | - | - | - |
| App | fortinet | fortiproxy | 7.2.0 | - | - |
| App | fortinet | fortiproxy | 7.2.1 | - | - |
| App | fortinet | fortiproxy | 7.2.2 | - | - |