Fortinet FortiNAC (Network Access Control) 9.4.0

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:fortinet:fortinac:9.4.0:*:*:*:*:*:*:*

part: a version: 9.4.0 update: *

VendorFortinet (2b06c5e0-0a17-54f4-810a-5ef236d51947)
ProductFortinac (6d4e0d5b-e68c-5b76-8f77-7241b663f1be)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2024-31488 vulnerable 2026-06-08 06:35:31.755457 Details available
MEDIUM (6.1)
An improper neutralization of inputs during web page generation vulnerability [CWE-79] in FortiNAC version 9.4.0 through 9.4.4, 9.2.0 through 9.2.8, 9.1.0 through 9.1.10, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 7.2.0 through 7.2.3 may allow a remote authenticated attacker to perform stored and reflected cross site scripting (XSS) attack via crafted HTTP requests.
Published: 2024-05-14T16:19:08.151Z
Updated: 2025-12-16T18:13:18.228Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-33299 vulnerable 2026-06-08 06:06:22.198962 Details available
CRITICAL (9.6)
A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier versions of 8.x allows attacker to execute unauthorized code or commands via specifically crafted request on inter-server communication port. Note FortiNAC versions 8.x will not be fixed.
Published: 2023-06-23T07:46:37.499Z
Updated: 2024-10-23T14:25:53.423Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-22638 vulnerable 2026-06-08 05:54:26.655933 Details available
MEDIUM (6.7)
Several improper neutralization of inputs during web page generation vulnerability [CWE-79] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.11 and below, 8.7.6 and below, 8.6.5 and below, 8.5.4 and below, 8.3.7 and below may allow an authenticated attacker to perform several XSS attacks via crafted HTTP GET requests.
Published: 2023-02-16T18:07:06.780Z
Updated: 2024-10-23T14:32:18.357Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-22633 vulnerable 2026-06-08 05:54:26.648739 Details available
HIGH (7.2)
An improper permissions, privileges, and access controls vulnerability [CWE-264] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.0 all versions 8.7.0 all versions may allow an unauthenticated attacker to perform a DoS attack on the device via client-secure renegotiation.
Published: 2023-06-13T08:41:44.268Z
Updated: 2024-10-23T14:26:31.560Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-40678 vulnerable 2026-06-08 05:48:27.883041 Details available
HIGH (7.4)
An insufficiently protected credentials in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow a local attacker with database access to recover user passwords.
Published: 2023-02-16T18:06:47.487Z
Updated: 2024-10-23T14:46:07.411Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-40677 vulnerable 2026-06-08 05:48:27.882504 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-40676 vulnerable 2026-06-08 05:48:27.881862 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-39953 vulnerable 2026-06-08 05:47:18.975957 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-39946 vulnerable 2026-06-08 05:47:18.964402 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.