# Fortinet

[5 tracked vendors](https://thirdpartyindex.com/vendors/fortinet#used-by) name Fortinet as a subprocessor, including [monday.com](https://thirdpartyindex.com/vendors/monday-com), [TierPoint](https://thirdpartyindex.com/vendors/tierpoint) and [Intralinks](https://thirdpartyindex.com/vendors/intralinks). We have not found a subprocessor list published by Fortinet. We monitor 1 of its documents, which we last checked on 2026-11-11.

Fortinet (fortinet.com): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index.

- Page: https://thirdpartyindex.com/vendors/fortinet
- Documents last verified: 2026-11-11
- Transparency rating: 16/100 (how much it publishes, not how secure it is): Subprocessor list 0/30 (not found); Processing locations 0/8 (no list); Purposes 0/7 (no list); Data processing addendum 0/12 (not found); Trust center 8/8; Privacy policy 0/6 (not found); security.txt 0/6 (not found); Security page 0/5 (not found); Status page 0/5 (not found); Vulnerability disclosure 0/5 (not found); Pages still reachable 8/8
- Supply chain: relies on 0 tracked vendors directly, 0 within two hops, 0 within three; 5 tracked vendors rely on it directly, 34 within two hops, 87 within three
- Cite as: Fortinet, Third Party Index, https://thirdpartyindex.com/vendors/fortinet (data CC BY 4.0)

## Documents

| Document | URL | Last verified | Last changed |
|---|---|---|---|
| Trust center | https://trust.fortinet.com/ | 2026-11-11 | 2026-10-28 |

## Subprocessors (0)

No subprocessor list has been found or read for this vendor.

## Compliance

As its trust center lists them.

- Audited: SOC 2, ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, ISO 9001, CSA STAR, BSI C5, TISAX, Cyber Essentials Plus, ISMAP ([evidence](https://thirdpartyindex.com/evidence/7630))
- Claimed: HIPAA, GDPR ([evidence](https://thirdpartyindex.com/evidence/7630))

## Security program

What Fortinet, Inc.'s Form 10-K for fiscal 2025, filed Feb 25, 2026 (Item 1C) says, in its words (https://www.sec.gov/Archives/edgar/data/1262039/000126203926000007/0001262039-26-000007-index.htm).

- Led by: Chief Information Security Officer, reporting to the board Cybersecurity Committee
- Leader's experience: 26+ years
- Board oversight: Audit Committee, Cybersecurity Committee
- Frameworks named: NIST CSF
- Practices named: Incident response plan, Tabletop exercises, Penetration testing, Vulnerability management, Threat intelligence
- Engages outside assessors or consultants
- Reviews its suppliers' security
- Says no cybersecurity incident has materially affected it

## Subprocessor of (5)

Tracked vendors whose own subprocessor lists name it, and what they say they use it for.

- [Intralinks](https://thirdpartyindex.com/vendors/intralinks.md)
- [Lightedge](https://thirdpartyindex.com/vendors/lightedge.md): Products & Services – Security
- [monday.com](https://thirdpartyindex.com/vendors/monday-com.md)
- [NCC Group](https://thirdpartyindex.com/vendors/ncc-group.md): Managed Firewall service
- [TierPoint](https://thirdpartyindex.com/vendors/tierpoint.md): Products & Services

## Security record

CISA's Known Exploited Vulnerabilities catalog lists 32 vulnerabilities in its software:

- CVE-2025-61624 (Multiple Products), listed 2026-10-16: Fortinet Multiple Products Path Traversal Vulnerability
- CVE-2026-104286 (FortiMail), listed 2026-10-01: Fortinet FortiMail Path Traversal Vulnerability
- CVE-2025-25249 (Multiple Products), listed 2026-09-09: Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability
- CVE-2025-68686 (FortiOS), listed 2026-07-27: Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
- CVE-2026-25089 (FortiSandbox), listed 2026-07-16: Fortinet FortiSandbox OS Command Injection Vulnerability
- CVE-2026-39808 (FortiSandbox), listed 2026-07-16: Fortinet FortiSandbox OS Command Injection Vulnerability
- CVE-2026-21643 (FortiClient EMS), listed 2026-04-13: Fortinet FortiClient EMS SQL Injection Vulnerability
- CVE-2026-35616 (FortiClient EMS), listed 2026-04-06: Fortinet FortiClient EMS Improper Access Control Vulnerability
- CVE-2026-24858 (Multiple Products), listed 2026-01-27: Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability
- CVE-2025-59718 (Multiple Products), listed 2025-12-16: Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability
- CVE-2025-58034 (FortiWeb), listed 2025-11-18: Fortinet FortiWeb OS Command Injection Vulnerability
- CVE-2025-64446 (FortiWeb), listed 2025-11-14: Fortinet FortiWeb Path Traversal Vulnerability
- CVE-2025-25257 (FortiWeb), listed 2025-07-18: Fortinet FortiWeb SQL Injection Vulnerability
- CVE-2019-6693 (FortiOS), listed 2025-06-25: Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability (known ransomware use)
- CVE-2025-32756 (Multiple Products), listed 2025-05-14: Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability
- CVE-2025-24472 (FortiOS and FortiProxy), listed 2025-03-18: Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability (known ransomware use)
- CVE-2024-55591 (FortiOS and FortiProxy), listed 2025-01-14: Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability (known ransomware use)
- CVE-2024-47575 (FortiManager), listed 2024-10-23: Fortinet FortiManager Missing Authentication Vulnerability
- CVE-2024-23113 (Multiple Products), listed 2024-10-09: Fortinet Multiple Products Format String Vulnerability
- CVE-2023-48788 (FortiClient EMS), listed 2024-03-25: Fortinet FortiClient EMS SQL Injection Vulnerability (known ransomware use)
- CVE-2024-21762 (FortiOS), listed 2024-02-09: Fortinet FortiOS Out-of-Bound Write Vulnerability (known ransomware use)
- CVE-2023-27997 (FortiOS and FortiProxy SSL-VPN), listed 2023-06-13: Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability (known ransomware use)
- CVE-2022-41328 (FortiOS), listed 2023-03-14: Fortinet FortiOS Path Traversal Vulnerability
- CVE-2022-42475 (FortiOS), listed 2022-12-13: Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability (known ransomware use)
- CVE-2022-40684 (Multiple Products), listed 2022-10-11: Fortinet Multiple Products Authentication Bypass Vulnerability (known ransomware use)
- CVE-2018-13374 (FortiOS and FortiADC), listed 2022-09-08: Fortinet FortiOS and FortiADC Improper Access Control Vulnerability (known ransomware use)
- CVE-2018-13382 (FortiOS and FortiProxy), listed 2022-01-10: Fortinet FortiOS and FortiProxy Improper Authorization (known ransomware use)
- CVE-2018-13383 (FortiOS and FortiProxy), listed 2022-01-10: Fortinet FortiOS and FortiProxy Out-of-bounds Write (known ransomware use)
- CVE-2021-44168 (FortiOS), listed 2021-12-10: Fortinet FortiOS Arbitrary File Download
- CVE-2018-13379 (FortiOS), listed 2021-11-03: Fortinet FortiOS SSL VPN Path Traversal Vulnerability (known ransomware use)
- CVE-2019-5591 (FortiOS), listed 2021-11-03: Fortinet FortiOS Default Configuration Vulnerability (known ransomware use)
- CVE-2020-12812 (FortiOS), listed 2021-11-03: Fortinet FortiOS SSL VPN Improper Authentication Vulnerability (known ransomware use)

---

Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api