{"apiVersion":"1","notice":"Security Threat Pulse API v1. Free, no key. Facts with sources; verdicts follow the published rules at https://securitythreatpulse.com/methodology. Not advice. Some source data is withheld here until its terms allow re-serving.","generatedAt":"2026-11-11T08:20:29.844Z","products":["fortinet","ivanti"],"actNowTotal":5,"results":[{"query":"fortinet","matched":4,"actNow":3,"events":[{"id":"kev-2026-10-16-fortinet-multiple-products","url":"https://securitythreatpulse.com/events/kev-2026-10-16-fortinet-multiple-products","title":"Several Fortinet products: attackers can read or change files","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 210 days old, so many systems are likely still unpatched.","tier":"now","rankScore":6,"rankWhy":["Exploitation is confirmed by an authoritative source.","The product faces the internet or gives remote access.","5 products are affected."],"rulesVersion":"v3","ladder":{"talk":"reported","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2025-61624"],"vendor":"Fortinet","product":"Multiple Products","affectedProducts":[{"kind":"direct","slug":"fortinet/multipleproducts","vendor":"Fortinet","product":"Multiple Products","evidence":["kev"],"vendorKey":"fortinet","productKey":"multipleproducts"},{"kind":"direct","slug":"fortinet/fortios","vendor":"Fortinet","product":"FortiOS","evidence":["cpe"],"vendorKey":"fortinet","productKey":"fortios"},{"kind":"direct","slug":"fortinet/fortiproxy","vendor":"Fortinet","product":"FortiProxy","evidence":["cpe"],"vendorKey":"fortinet","productKey":"fortiproxy"},{"kind":"direct","slug":"fortinet/fortiswitchmanager","vendor":"Fortinet","product":"Fortiswitchmanager","evidence":["cpe"],"vendorKey":"fortinet","productKey":"fortiswitchmanager"},{"kind":"direct","slug":"fortinet/fortipam","vendor":"Fortinet","product":"Fortipam","evidence":["cpe"],"vendorKey":"fortinet","productKey":"fortipam"}],"category":{"id":"edge","label":"VPN, firewall or gateway","why":"It sits at the edge of your network and faces the internet, so attackers can reach it directly.","doThis":"If you have it, patch it today. If you cannot, block access to it from the internet until you can."},"summary":"FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.","cvss":5.4,"epss":0.01343,"exploitMaturity":"none","kevListed":true,"kevDateAdded":"2026-10-16","kevDueDate":"2026-10-19","firstSeenAt":"2026-10-16T00:00:00.000Z","updatedAt":"2026-11-10T16:00:06.550Z","newestEvidenceAt":"2026-11-05T10:56:45.699Z"},{"id":"kev-2026-10-01-fortinet-fortimail","url":"https://securitythreatpulse.com/events/kev-2026-10-01-fortinet-fortimail","title":"Fortinet FortiMail: attackers can read or change files","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 40 days old, so many systems are likely still unpatched. The severity score is critical (9.8).","tier":"now","rankScore":5,"rankWhy":["Exploitation is confirmed by an authoritative source.","The product faces the internet or gives remote access."],"rulesVersion":"v3","ladder":{"talk":"reported","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-104286"],"vendor":"Fortinet","product":"FortiMail","affectedProducts":[{"kind":"direct","slug":"fortinet/fortimail","vendor":"Fortinet","product":"FortiMail","evidence":["kev","cpe"],"vendorKey":"fortinet","productKey":"fortimail"}],"category":{"id":"edge","label":"VPN, firewall or gateway","why":"It sits at the edge of your network and faces the internet, so attackers can reach it directly.","doThis":"If you have it, patch it today. If you cannot, block access to it from the internet until you can."},"summary":"Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.","cvss":9.8,"epss":0.04573,"exploitMaturity":"poc","kevListed":true,"kevDateAdded":"2026-10-01","kevDueDate":"2026-10-04","firstSeenAt":"2026-10-01T00:00:00.000Z","updatedAt":"2026-11-10T19:31:15.956Z","newestEvidenceAt":"2026-11-04T13:44:26.692Z"},{"id":"kev-2026-09-09-fortinet-multiple-products","url":"https://securitythreatpulse.com/events/kev-2026-09-09-fortinet-multiple-products","title":"Several Fortinet products: a memory flaw attackers can abuse","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 299 days old, so many systems are likely still unpatched.","tier":"now","rankScore":5,"rankWhy":["Exploitation is confirmed by an authoritative source.","The product faces the internet or gives remote access."],"rulesVersion":"v3","ladder":{"talk":"none","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2025-25249"],"vendor":"Fortinet","product":"Multiple Products","affectedProducts":[{"kind":"direct","slug":"fortinet/multipleproducts","vendor":"Fortinet","product":"Multiple Products","evidence":["kev"],"vendorKey":"fortinet","productKey":"multipleproducts"}],"category":{"id":"edge","label":"VPN, firewall or gateway","why":"It sits at the edge of your network and faces the internet, so attackers can reach it directly.","doThis":"If you have it, patch it today. If you cannot, block access to it from the internet until you can."},"summary":"Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets.","cvss":7.4,"epss":0.03742,"exploitMaturity":"none","kevListed":true,"kevDateAdded":"2026-09-09","kevDueDate":"2026-09-12","firstSeenAt":"2026-09-09T00:00:00.000Z","updatedAt":"2026-11-08T16:37:40.566Z","newestEvidenceAt":"2026-09-09T00:00:00.000Z"},{"id":"early-cve-2022-39952","url":"https://securitythreatpulse.com/events/early-cve-2022-39952","title":"Fortinet FortiNAC: attackers can read or change files","verdict":"watch","verdictReason":"Attack attempts are confirmed, with no confirmed exploitation yet.","tier":null,"rankScore":4,"rankWhy":["The product faces the internet or gives remote access.","Ready-made attack tools are public.","The first report is 20 days old."],"rulesVersion":"v3","ladder":{"talk":"none","damage":"none","attempts":"confirmed","exposure":"none","exploited":"none"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2022-39952"],"vendor":"Fortinet","product":"FortiNAC","affectedProducts":[{"kind":"direct","slug":"fortinet/fortinac","vendor":"Fortinet","product":"FortiNAC","evidence":["cna","cpe"],"vendorKey":"fortinet","productKey":"fortinac"}],"category":{"id":"edge","label":"VPN, firewall or gateway","why":"It sits at the edge of your network and faces the internet, so attackers can reach it directly.","doThis":"If you have it, patch it today. If you cannot, block access to it from the internet until you can."},"summary":"A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP request.","cvss":9.8,"epss":0.99794,"exploitMaturity":"weaponized","kevListed":false,"kevDateAdded":null,"kevDueDate":null,"firstSeenAt":"2026-10-22T00:00:00.000Z","updatedAt":"2026-11-11T00:00:06.173Z","newestEvidenceAt":"2026-10-24T23:23:07.970Z"}]},{"query":"ivanti","matched":2,"actNow":2,"events":[{"id":"kev-2026-10-30-ivanti-connect-secure","url":"https://securitythreatpulse.com/events/kev-2026-10-30-ivanti-connect-secure","title":"Ivanti Connect Secure: 2 flaws used in attacks; attackers can get in without a password","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 7 days old, so many systems are likely still unpatched. It affects a product that faces the internet or gives remote access.","tier":"today","rankScore":6,"rankWhy":["Exploitation is confirmed by an authoritative source.","The product faces the internet or gives remote access.","The confirmation is 12 days old."],"rulesVersion":"v3","ladder":{"talk":"confirmed","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-111357","CVE-2026-118527"],"vendor":"Ivanti","product":"Connect Secure","affectedProducts":[{"kind":"direct","slug":"ivanti/connectsecure","vendor":"Ivanti","product":"Connect Secure","evidence":["kev","cpe"],"vendorKey":"ivanti","productKey":"connectsecure"}],"category":{"id":"edge","label":"VPN, firewall or gateway","why":"It sits at the edge of your network and faces the internet, so attackers can reach it directly.","doThis":"If you have it, patch it today. If you cannot, block access to it from the internet until you can."},"summary":"Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527.","cvss":7,"epss":0.00822,"exploitMaturity":"none","kevListed":true,"kevDateAdded":"2026-10-30","kevDueDate":"2026-11-02","firstSeenAt":"2026-10-30T00:00:00.000Z","updatedAt":"2026-11-11T00:00:06.173Z","newestEvidenceAt":"2026-11-08T13:00:20.484Z"},{"id":"kev-2026-10-13-ivanti-connect-secure","url":"https://securitythreatpulse.com/events/kev-2026-10-13-ivanti-connect-secure","title":"Ivanti Connect Secure: attackers can get in without a password","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 28 days old, so many systems are likely still unpatched. Ready-made attack tools are public. It affects a product that faces the internet or gives remote access. The exploit prediction score is 89%.","tier":"now","rankScore":6,"rankWhy":["Exploitation is confirmed by an authoritative source.","The product faces the internet or gives remote access.","Ready-made attack tools are public."],"rulesVersion":"v3","ladder":{"talk":"confirmed","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-104935"],"vendor":"Ivanti","product":"Connect Secure","affectedProducts":[{"kind":"direct","slug":"ivanti/connectsecure","vendor":"Ivanti","product":"Connect Secure","evidence":["kev","cpe"],"vendorKey":"ivanti","productKey":"connectsecure"}],"category":{"id":"edge","label":"VPN, firewall or gateway","why":"It sits at the edge of your network and faces the internet, so attackers can reach it directly.","doThis":"If you have it, patch it today. If you cannot, block access to it from the internet until you can."},"summary":"Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.","cvss":8.6,"epss":0.88936,"exploitMaturity":"weaponized","kevListed":true,"kevDateAdded":"2026-10-13","kevDueDate":"2026-10-16","firstSeenAt":"2026-10-13T00:00:00.000Z","updatedAt":"2026-11-10T16:00:06.550Z","newestEvidenceAt":"2026-11-03T15:19:11.536Z"}]}]}