FortiOS 5.4
5.4Fortinet · OS release · FortiOS Series
Unsupported since · 2333 days ago
FortiOS 5.4 reached end of support on (2333 days ago).
- Notice published
- 10y 11mo ago
- End of software maintenance
- 7y 11mo ago
- End of security support
- 7y 11mo ago
- End of support
- 6y 5mo ago
Lifecycle Milestones
| Lifecycle notice published | 10y 11mo ago | |
|---|---|---|
| End of software maintenance | 7y 11mo ago | |
| End of security vulnerability support | 7y 11mo ago | |
| Last date of support | 6y 5mo ago |
Known Exploited Vulnerabilities
10 CVEs in CISA's Known Exploited Vulnerabilities catalog are recorded against the Fortinet platform this release belongs to and may apply to this release; verify against the vendor advisory before acting. Fortinet security vulnerability support for this release stopped on . Where one applies, upgrade, isolate, or compensate.
| CVE | KEV added | Vulnerability | Flags |
|---|---|---|---|
CVE-2025-68686
|
Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
KEV added 2026-07-27
|
||
CVE-2019-6693
|
Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability
KEV added 2025-06-25 · Ransomware
|
Ransomware | |
CVE-2022-42475
|
Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability
KEV added 2022-12-13 · Ransomware
|
Ransomware | |
CVE-2018-13374
|
Fortinet FortiOS and FortiADC Improper Access Control Vulnerability
KEV added 2022-09-08 · Ransomware
|
Ransomware | |
CVE-2018-13382
|
Fortinet FortiOS and FortiProxy Improper Authorization
KEV added 2022-01-10 · Ransomware
|
Ransomware | |
CVE-2018-13383
|
Fortinet FortiOS and FortiProxy Out-of-bounds Write
KEV added 2022-01-10 · Ransomware
|
Ransomware | |
CVE-2021-44168
|
Fortinet FortiOS Arbitrary File Download
KEV added 2021-12-10
|
||
CVE-2019-5591
|
Fortinet FortiOS Default Configuration Vulnerability
KEV added 2021-11-03 · Ransomware
|
Ransomware | |
CVE-2020-12812
|
Fortinet FortiOS SSL VPN Improper Authentication Vulnerability
KEV added 2021-11-03 · Ransomware
|
Ransomware | |
CVE-2018-13379
|
Fortinet FortiOS SSL VPN Path Traversal Vulnerability
KEV added 2021-11-03 · Ransomware
|
Ransomware |
Source: CISA Known Exploited Vulnerabilities catalog. The Ransomware flag reflects CISA's own knownRansomwareCampaignUse field, set when the CVE has been observed in ransomware campaigns per their threat intel. It's not a property of the vulnerability description itself.
Correlation is at the platform level, not per-OS-version (entries disclosed well before this release train shipped are left out). Not exhaustive: KEV only lists actively-exploited CVEs and many relevant unexploited vulnerabilities are not here. Verify against vendor security advisories (PSIRT, JSA, PAN-SA) and NVD before acting. See compensating controls if refresh isn't immediate.
Is FortiOS 5.4 still maintained?
No. Fortinet no longer maintains FortiOS 5.4; support ended on 2020-06-21. It receives no fixes of any kind, including security patches. Plan an upgrade to a maintained release. See Fortinet's lifecycle bulletin.
When do security fixes for FortiOS 5.4 stop?
Fortinet stopped engineering fixes for FortiOS 5.4, including security patches, on 2018-12-21. A device on this release cannot be patched against vulnerabilities disclosed after that date without upgrading.
What should I upgrade FortiOS 5.4 to?
Upgrade to a currently maintained Fortinet release. Check Fortinet's release notes for the recommended version.
Which known-exploited CVEs may apply to the FortiOS 5.4?
10 CVEs in CISA's Known Exploited Vulnerabilities catalog are recorded against Fortinet FortiOS and may apply to FortiOS 5.4, whose security fixes stopped on 2018-12-21. Verify each against the vendor advisory for the fixed releases before acting. See the Known Exploited Vulnerabilities table for the full list.
FortiOS 5.4 Release Lifecycle
FortiOS 5.4 is a Fortinet FortiOS software release. Releases are maintained on a fixed schedule: Fortinet ships fixes and security patches until the release reaches end of engineering, after which a device must be upgraded to a maintained release to stay patchable. The dates below are milestones for the software train, not for any specific appliance — hardware running this release has its own separate lifecycle. This product has reached end of life as of , meaning Fortinet no longer provides technical support, software updates, or hardware replacement for this product. Organizations still running the FortiOS 5.4 should plan a migration .