What’s Vulnerable › Vulnerabilities
CVE-2020-9295
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-03-17 · updated 2026-06-17
- Weakness: CWE-358
Description
FortiOS 6.2 running AV engine version 6.00142 and below, FortiOS 6.4 running AV engine version 6.00144 and below and FortiClient 6.2 running AV engine version 6.00137 and below may not immediately detect certain types of malformed or non-standard RAR archives, potentially containing malicious files. Based on the samples provided, FortiClient will detect the malicious files upon trying extraction by real-time scanning and FortiGate will detect the malicious archive if Virus Outbreak Prevention is enabled.
Affected products
- Fortinet Antivirus Engine: before 6.00145 — fixed in 6.00145
How to fix
Upgrade to a fixed version: Fortinet Antivirus Engine 6.00145. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2020-9295 or the next vulnerability affects your stack