https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-64153.htmlhttps://patchthecve.com/cve/CVE-2025-64153.htmlWed, 14 Oct 2026 21:10:00 +0000HIGH 7.2: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7.6.0 through 7.6.3, FortiExtender 7.4.0 through 7.4.7, FortiExtender 7.2 all versions, FortiExtender 7.0 all versions may allow an authenticated attacker to execute unauthorized cohttps://patchthecve.com/cve/CVE-2025-46776.htmlhttps://patchthecve.com/cve/CVE-2025-46776.htmlSun, 18 Oct 2026 20:10:00 +0000MEDIUM 6.4: A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiExtender 7.6.0 through 7.6.1, FortiExtender 7.4.0 through 7.4.6, FortiExtender 7.2 all versions, FortiExtender 7.0 all versions may allow an authenticated user to execute arbitrary code or commandhttps://patchthecve.com/cve/CVE-2025-46775.htmlhttps://patchthecve.com/cve/CVE-2025-46775.htmlSun, 18 Oct 2026 20:10:00 +0000MEDIUM 5.5: A debug messages revealing unnecessary information vulnerability in Fortinet FortiExtender 7.6.0 through 7.6.1, FortiExtender 7.4.0 through 7.4.6, FortiExtender 7.2 all versions, FortiExtender 7.0 all versions may allow an authenticated user to obtain administrator credentials via debug log commandshttps://patchthecve.com/cve/CVE-2024-23663.htmlhttps://patchthecve.com/cve/CVE-2024-23663.htmlWed, 17 Jun 2026 07:13:20 +0000HIGH 8.8: An improper access control in Fortinet FortiExtender 4.1.1 - 4.1.9, 4.2.0 - 4.2.6, 5.3.2, 7.0.0 - 7.0.4, 7.2.0 - 7.2.4 and 7.4.0 - 7.4.2 allows an attacker to create users with elevated privileges via a crafted HTTP request.https://patchthecve.com/cve/CVE-2022-23447.htmlhttps://patchthecve.com/cve/CVE-2022-23447.htmlWed, 17 Jun 2026 04:30:08 +0000HIGH 7.5: An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in FortiExtender management interface 7.0.0 through 7.0.3, 4.2.0 through 4.2.4, 4.1.1 through 4.1.8, 4.0.0 through 4.0.2, 3.3.0 through 3.3.2, 3.2.1 through 3.2.3, 5.3 all versions may allow an https://patchthecve.com/cve/CVE-2022-27489.htmlhttps://patchthecve.com/cve/CVE-2022-27489.htmlWed, 17 Jun 2026 04:37:06 +0000HIGH 7.2: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7.0.0 through 7.0.3, 5.3.2, 4.2.4 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests.https://patchthecve.com/cve/CVE-2021-41016.htmlhttps://patchthecve.com/cve/CVE-2021-41016.htmlWed, 17 Jun 2026 04:07:44 +0000HIGH 7.8: A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiExtender version 7.0.1 and below, 4.2.3 and below, 4.1.7 and below allows an authenticated attacker to execute privileged shell commands via CLI commands including special charactershttps://patchthecve.com/cve/CVE-2019-15710.htmlhttps://patchthecve.com/cve/CVE-2019-15710.htmlWed, 17 Jun 2026 02:20:55 +0000HIGH 7.2: An OS command injection vulnerability in FortiExtender 4.1.0 to 4.1.1, 4.0.0 and below under CLI admin console may allow unauthorized administrators to run arbitrary system level commands via specially crafted "execute date" commands.