Meraki vs Fortinet

The gap is not close, and it does not rest on one bad year. Fortinet published 340 CVE-bearing advisories across 2023–2025. Cisco Meraki published 12. That is a factor of 28.3×.

Severity widens it further. Fortinet lost 34 advisories to the critical class; Meraki lost 0. The measure that matters most — confirmed exploitation — reads 14 against 0.

A count does not explain why one platform draws fire. This is the chain attackers ran against internet-facing FortiGate appliances, rebuilt from published reporting of the credential campaign. Every stage is documented.

Every row below is a confirmed exploitation, not a suspicion. CISA also flags the entries ransomware operators used. Meraki is absent from every year.

Verified two ways: the NVD series above, and a text scan of all 1,734 catalog entries for the string “Meraki”.

In June 2026 researchers published working administrator and SSL VPN credentials for approximately 74,000 internet-facing FortiGate appliances, drawn from more than 21,000 IP addresses across 194 countries — roughly half of all internet-facing FortiGates in existence. CISA issued an alert on 18 June 2026. The FBI and the Secret Service followed with a joint advisory.

There is no CVE and no patch, because the cause is exposure plus credential weakness: management interfaces reachable from the internet, and legacy SHA-256 password hashing that persisted after upgrades until each administrator signed in again. Captured hashes were cracked on a 45-GPU cluster, then used to enter Active Directory and Radius.

• Where the management plane lives. A Meraki device is managed from the cloud dashboard, so the customer edge publishes no administrative interface. A FortiGate is self-managed, and its management interface and SSL-VPN portal are frequently reachable from the internet. That reachability is the initial-access surface.
• Who applies the patch. Meraki firmware moves through the dashboard, so the vendor controls the upgrade path. FortiOS upgrades are customer-driven, so unpatched devices accumulate — and that long tail is what scanners find.
• Attacker payoff. A compromised firewall is a network tap. It sees authentication traffic, and its credentials open Active Directory and Radius. A denied VPN session is an inconvenience by comparison. The Meraki advisories in this window are almost entirely denial-of-service and privilege-escalation class; the Fortinet set includes pre-authentication remote code execution and authentication bypass.
• Target density. Fortinet holds roughly 15% of the global firewall market, heavily on internet-facing perimeters. One working exploit has a very large addressable set, so tooling gets written for it.
• Credential storage. FortiOS kept SHA-256 with salt for administrator credentials after the move to PBKDF2, until each administrator re-authenticated. Offline cracking was therefore practical, and that turned a configuration leak into 74,000 working logins.
• Product count. Fortinet exposes many separately reachable products — FortiOS, FortiProxy, FortiWeb, FortiManager, FortiClient EMS, FortiSandbox, FortiMail. Each is its own target with its own advisory stream. Meraki exposes one managed platform behind a dashboard.

• Vulnerability counts. NVD API 2.0, keywordSearch on the vendor name, grouped by first-published date. NVD rejects date ranges longer than 120 days, so each year was sliced into windows of 110 days or fewer and the windows were summed.
• Exploitation counts. CISA KEV catalog, snapshot 2026.10.04, 1,734 entries, counted by vendor project and date added.
• The zero check. All 1,734 entries were scanned for the string “Meraki” across product, name and description. The result was zero. Measured, not assumed.
• Numbers are generated. The build script refuses to emit this page if a figure disagrees with the source data.

Three limits

• The Meraki count is a floor. Keyword search matches description text, so a Meraki CVE named only in its CPE data can be missed. The true figure is equal or slightly higher. The direction of the error does not change the verdict.
• The 2026 Meraki row undercounts. Cisco published a Meraki hardening advisory on 7 October 2026, one day before this document, with seven CVEs and a CVSS base of 9.6 on the buffer overflow (CVE-2026-76464). NVD had not indexed those records when the count ran. Cisco states they were found in internal testing and are not known to be exploited. It is the first critical-class Meraki advisory in the period reviewed, and it falls outside the window.
• Breaches are qualitative. Exploitation is counted exactly, from CISA. Breach events are enumerated from public reporting, and a breach never disclosed is invisible to this method.