Fortinet Fortideceptor — known CVE vulnerabilities

Every CVE whose affected-product data names Fortinet Fortideceptor, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (11)

• CVE-2020-29017 — CVSS 8.8 (high): An OS command injection vulnerability in FortiDeceptor 3.1.0, 3.0.1, 3.0.0 may allow a remote authenticated attacker to execute arbitrary…
• CVE-2022-27487 — CVSS 8.8 (high): A improper privilege management in Fortinet FortiSandbox version 4.2.0 through 4.2.2, 4.0.0 through 4.0.2 and before 3.2.3 and…
• CVE-2020-6644 — CVSS 8.1 (high): An insufficient session expiration vulnerability in FortiDeceptor 3.0.0 and below allows an attacker to reuse the unexpired admin user…
• CVE-2022-38373 — CVSS 8.0 (high): An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiDeceptor management interface 4.2.0, 4.1.0…
• CVE-2026-25689 — CVSS 6.5 (medium): An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor 6.2.0…
• CVE-2022-30302 — CVSS 6.5 (medium): Multiple relative path traversal vulnerabilities [CWE-23] in FortiDeceptor management interface 1.0.0 through 3.2.x, 3.3.0 through 3.3.2…
• CVE-2024-35280 — CVSS 5.4 (medium): A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiDeceptor 5.3.0…
• CVE-2024-45326 — CVSS 4.3 (medium): An Improper Access Control vulnerability [CWE-284] vulnerability in Fortinet FortiDeceptor 6.0.0, FortiDeceptor 5.3 all versions…
• CVE-2026-25690 — CVSS 4.3 (medium): An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor 6.0.0 through…
• CVE-2022-30305 — CVSS 3.7 (low): An insufficient logging [CWE-778] vulnerability in FortiSandbox versions 4.0.0 to 4.0.2, 3.2.0 to 3.2.3 and 3.1.0 to 3.1.5 and…
• CVE-2023-26209 — CVSS 3.7 (low): A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiDeceptor 3.1.x and before allows a…