FortiAuthenticator vulnerabilitiesRanked by how likely they are to be used.
FortiAuthenticator is made by Fortinet. We track 21 published vulnerabilities listed under that exact name, across 65 versions. None of them is on the list of flaws known to be exploited today. Fortinet lists newer releases under their own names, such as FortiAuthenticator Agent for Microsoft Outlook Web Access, so check those pages too.
We keep watching the known-exploited list.
Is FortiAuthenticator listed under other names? Yes.
Fortinet also lists FortiAuthenticator under more specific names, such as FortiAuthenticator Agent for Microsoft Outlook Web Access. Flaws listed only under those names are counted on their own pages, not here. If you run one of these, open its page for its own exploited flaws.
Which FortiAuthenticator vulnerabilities are being exploited?
This is the list that matters most: flaws criminals are using now.
None of FortiAuthenticator's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.
Which FortiAuthenticator flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 2.7%CVE-2015-1455High
Fortinet FortiAuthenticator 3.0.0 has a password of (1) slony for the slony PostgreSQL user and (2) www-data for the www-data PostgreSQL user, which makes it easier for remote attackers to obtain access via...
- 2.0%CVE-2015-1459Medium
Cross-site scripting (XSS) vulnerability in Fortinet FortiAuthenticator 3.0.0 allows remote attackers to inject arbitrary web script or HTML via the operation parameter to cert/scep/.
- 1.8%CVE-2023-26208Medium
A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiAuthenticator 6.4.x and before allows a remote unauthenticated attacker to partially exhaust CPU and memory via...
- 1.4%CVE-2015-1456Medium
Fortinet FortiAuthenticator 3.0.0 logs the PostgreSQL usernames and passwords in cleartext, which allows remote administrators to obtain sensitive information by reading the log at debug/startup/.
- 1.1%CVE-2021-43067Medium
A exposure of sensitive information to an unauthorized actor in Fortinet FortiAuthenticator version 6.4.0, version 6.3.2 and below, version 6.2.1 and below, version 6.1.2 and below, version 6.0.7 to 6.0.1 allows...
- 1.1%CVE-2013-6990Critical
FortiGuard FortiAuthenticator before 3.0 allows remote administrators to gain privileges via the command line interface.
- 1.0%CVE-2021-22124High
An uncontrolled resource consumption (denial of service) vulnerability in the login modules of FortiSandbox 3.2.0 through 3.2.2, 3.1.0 through 3.1.4, and 3.0.0 through 3.0.6; and FortiAuthenticator before 6.0.6 may...
- 0.7%CVE-2018-9186Medium
A cross-site scripting (XSS) vulnerability in Fortinet FortiAuthenticator in versions 4.0.0 to before 5.3.0 "CSRF validation failure" page allows attacker to execute unauthorized script code via inject malicious...
- 0.7%CVE-2019-16154Medium
An improper neutralization of input during web page generation in FortiAuthenticator WEB UI 6.0.0 may allow an unauthenticated user to perform a cross-site scripting attack (XSS) via a parameter of the logon page.
- 0.6%CVE-2021-26116High
An improper neutralization of special elements used in an OS command vulnerability in the command line interpreter of FortiAuthenticator before 6.3.1 may allow an authenticated attacker to execute unauthorized...
Running FortiAuthenticator? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 new flaw affects software Acme tracks
Fortinet FortiAuthenticator 3.0.0 has a password of (1) slony for the slony PostgreSQL user and (2) www-data for the www-data PostgreSQL user, which makes it easier for remote attackers to obtain access via unspecified vectors.
- Matched to
- FortiAuthenticator on Acme's software list
- What to do
- Plan in the vendor’s update
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 21 published vulnerabilities listed under the name FortiAuthenticator, across 65 versions.
None of FortiAuthenticator's vulnerabilities is on the list of flaws known to be exploited today.
Fortinet also lists FortiAuthenticator under more specific names, such as FortiAuthenticator Agent for Microsoft Outlook Web Access. Flaws listed only under those names are counted on their own pages, not here. Open the release you run to see its own list.
Create a Precursor Intelligence account and track FortiAuthenticator. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.