Fortinet Fortinac-f — known CVE vulnerabilities

Every CVE whose affected-product data names Fortinet Fortinac-f, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (13)

• CVE-2026-24858 — CVSS 9.8 (critical) — actively exploited: An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through…
• CVE-2022-38375 — CVSS 9.1 (critical): An improper authorization vulnerability [CWE-285] in Fortinet FortiNAC version 9.4.0 through 9.4.1 and before 9.2.6 allows an…
• CVE-2023-22633 — CVSS 7.5 (high): An improper permissions, privileges, and access controls vulnerability [CWE-264] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and…
• CVE-2022-39954 — CVSS 7.3 (high): An improper restriction of xml external entity reference in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through…
• CVE-2023-26203 — CVSS 6.7 (medium): A use of hard-coded credentials vulnerability [CWE-798] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions…
• CVE-2022-40675 — CVSS 6.5 (medium): Some cryptographic issues in Fortinet FortiNAC versions 9.4.0 through 9.4.1, 9.2.0 through 9.2.7, 9.1.0 through 9.1.8, 8.8.0 through…
• CVE-2023-22637 — CVSS 6.5 (medium): An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiNAC-F version 7.2.0…
• CVE-2022-43951 — CVSS 5.3 (medium): An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8…
• CVE-2022-45860 — CVSS 5.3 (medium): A weak authentication vulnerability [CWE-1390] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all…
• CVE-2023-48785 — CVSS 4.8 (medium): An improper certificate validation vulnerability [CWE-295] in FortiNAC-F version 7.2.4 and below may allow a remote and unauthenticated…
• CVE-2022-43950 — CVSS 4.3 (medium): A URL redirection to untrusted site ('Open Redirect') vulnerability [CWE-601] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.1 and…
• CVE-2022-45859 — CVSS 4.1 (medium): An insufficiently protected credentials vulnerability [CWE-522] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and…
• CVE-2026-21741 — CVSS 2.4 (low): An URL Redirection to Untrusted Site ('Open Redirect') vulnerability [CWE-601] vulnerability in Fortinet FortiNAC-F 7.6.0 through 7.6.5…