News · Fortinet PSIRT Advisories

• Fortinet PSIRT Advisories Mon 26 Oct

  Node2Shell CVEs

  CVSSv3 Score: 9.8 CVE-2026-105482 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105483 - (high)This vulnerability affects Node.js 26.x and 24.x.CVE-2026-106069 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-111497 - (high)A flaw in Node.js can cause Node.js Brotli decoder out-of-bounds write permits remote code execution.This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105481 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106072 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE…

  CVE-2026-105482, CVE-2026-105483, CVE-2026-106069 +3
• Fortinet PSIRT Advisories 21 Oct

  PHP2Shell core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)

  CVSSv3 Score: 9.8 CVE-2026-109618PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).CVE-2026-109619PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be…

  CVE-2026-109618, CVE-2026-109619
• Fortinet PSIRT Advisories 13 Oct

  arbitrary command execution in fgfmsd daemon

  CVSSv3 Score: 5.3 An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiManager fgfmd daemon may allow a remote attacker impersonating a fortimanager cluster node to execute unauthorized code or commands via specially crafted packets. Impersonation of a Fortimanager cluster node requires possessing the node's certificate and private key. Revised on 2026-10-13 00:00:00
• Fortinet PSIRT Advisories 13 Oct

  SQL command injection in webmail

  CVSSv3 Score: 7.7 An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] in FortiMail webmail may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests. Revised on 2026-10-13 00:00:00
• Fortinet PSIRT Advisories 13 Oct

  Persistent Denial of Service in Admin Profile

  CVSSv3 Score: 4.8 An Uncaught Exception vulnerability [CWE-248] in FortiSandbox may allow a privileged attacker to deny access to the GUI and CLI persistently via crafted HTTP requests. Revised on 2026-10-13 00:00:00
• Fortinet PSIRT Advisories 13 Oct

  Multiple Arbitrary File Read/Write via SQL Injection

  CVSSv3 Score: 7.9 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiAnalyzer, FortiManager, FortiManager Cloud and FortiAnalyzer Cloud may allow a low privileged user to execute arbitrary commands via crafted requests. Revised on 2026-10-13 00:00:00
• Fortinet PSIRT Advisories 13 Oct

  Improper access control and session management in the web management interface

  CVSSv3 Score: 9.6 An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiSandbox GUI may allow a remote unauthenticated attacker to bypass authentication via crafted HTTP requests. Revised on 2026-10-13 00:00:00
• Fortinet PSIRT Advisories 13 Oct

  HTML injection in WebUI

  CVSSv3 Score: 4.9 An improper neutralization of script-related HTML tags in a web page in FortiManager and FortiAnalyzer may allow an attacker to perform a cross site scripting (XSS) attack via the Identify Provider name field. Revised on 2026-10-13 00:00:00
• Fortinet PSIRT Advisories 13 Oct

  GUI Denial of Service

  CVSSv3 Score: 6.7 An Improper Locking vulnerability [CWE-667] in FortiOS may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP requests. Revised on 2026-10-13 00:00:00
• Fortinet PSIRT Advisories 13 Oct

  Fabric API Authentication bypass

  CVSSv3 Score: 4.9 A Use of Hard-coded Cryptographic Key [CWE-321] in FortiSandbox and FortiSandbox Cloud API may allow an unauthenticated attacker to access some endpoints via specially crafted HTTP requests Revised on 2026-10-13 00:00:00
• Fortinet PSIRT Advisories 13 Oct

  Double free in signal handler

  CVSSv3 Score: 2.1 A Double Free vulnerability [CWE-415] in FortiOS, FortiProxy and FortiSwitch may allow a local authenticated attacker to crash the newcli daemon via crafted CLI commands. Revised on 2026-10-13 00:00:00
• Fortinet PSIRT Advisories 13 Oct

  Broken authorization

  CVSSv3 Score: 3.4 A missing authorization vulnerability [CWE-862] in FortiSIEM GUI may allow an authenticated attacker to execute unauthorized code or commands via Specially crafted HTTP requests Revised on 2026-10-13 00:00:00
• Fortinet PSIRT Advisories 13 Oct

  Arbitrary file write in grpc phQueryMaster

  CVSSv3 Score: 9.4 An Improper limitation of a pathname to a restricted directory ('path traversal') [CWE-22] in FortiSIEM may allow an unauthenticated attacker to execute unauthorized code or commands via specially crafted packets. Revised on 2026-10-13 00:00:00
• Fortinet PSIRT Advisories 1 Oct

  Improper limitation of a pathname to a restricted directory

  CVSSv3 Score: 9.8 An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] and Improper Neutralization of NULL Byte or NULL Character [CWE-158] vulnerability may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.This has been reported to be exploited in the wild, customers are urged to apply the workaround below. Revised on 2026-10-07 00:00:00
• Fortinet PSIRT Advisories 8 Sep

  ZTNA Portal Improper Certificate Validation

  CVSSv3 Score: 8.1 An improper certificate validation vulnerability [CWE-295] in FortiOS and FortiProxy Agentless ZTNA portal may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the ZTNA portal and the backend destination website. Revised on 2026-09-08 00:00:00
• Fortinet PSIRT Advisories 8 Sep

  Workflow session email approval process bypass

  CVSSv3 Score: 4.9 An improper access control vulnerability [CWE-284] in FortiManager may allow an administrator to bypass the approval process for workflow sessions via crafted HTTP or HTTPs requests. Revised on 2026-09-08 00:00:00
• Fortinet PSIRT Advisories 8 Sep

  Uncontrolled Resource Consumption in SNMP

  CVSSv3 Score: 6.5 A Use of Uninitialized Variable [CWE-457] vulnerability in Fortinet FortiAnalyzer SNMP daemon may allow a remote authenticated attacker with user permission to cause a denial of service via SNMP GETBULK requests. Revised on 2026-09-08 00:00:00
• Fortinet PSIRT Advisories 8 Sep

  Unauthenticated Control of NAT Rules Leading to Exposure of Sensitive Information

  CVSSv3 Score: 9.9 An improper access control vulnerability [CWE-284] in FortiSandbox, FortiSandbox Cloud and FortiSandbox PaaS WEB UI may allow an unauthenticated attacker to access sensitive information via crafted HTTP requests. Revised on 2026-09-08 00:00:00
• Fortinet PSIRT Advisories 8 Sep

  Open Redirect on FortiSIEM

  CVSSv3 Score: 3.1 An URL redirection to untrusted site ('open redirect') [CWE-601] vulnerability in FortiSIEM may allow an authenticated attacker to cause a redirection to any website via specially crafted HTTP requests Revised on 2026-09-08 00:00:00
• Fortinet PSIRT Advisories 8 Sep

  Null Pointer Dereference in Log Report

  CVSSv3 Score: 2.7 A NULL Pointer Dereference vulnerability [CWE-476] in FortiOS, FortiProxy and FortiPAM may allow an authenticated attacker to crash the httpsd daemon via crafted HTTP requests. Revised on 2026-09-08 00:00:00
• Fortinet PSIRT Advisories 8 Sep

  JWT used for authentication in web GUI signed with static key

  CVSSv3 Score: 9.8 An Inclusion of Sensitive Information in Source Code vulnerability [CWE-540] in FortiMonitorOnSight web portal may allow a remote unauthenticated attacker to bypass authentication via forged or reused JWT Revised on 2026-09-08 00:00:00
• Fortinet PSIRT Advisories 8 Sep

  Improper Authentication of FortiPAM Server

  CVSSv3 Score: 9.6 An improper authentication vulnerability [CWE-287] in the Fortinet Privileged Access Agent Chrome Extension may allow a remote unauthenticated attacker to proxy a user's browser traffic through attacker controlled servers if the user visits a malicious website. Revised on 2026-09-08 00:00:00
• Fortinet PSIRT Advisories 8 Sep

  Cron Job Injection in Remote Backup

  CVSSv3 Score: 7.2 An Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability [CWE-77] in FortiSandbox may allow a privileged attacker to execute unauthorized code or commands via crafted HTTP requests. Revised on 2026-09-08 00:00:00
• Fortinet PSIRT Advisories 8 Sep

  Broken Access control on Websocket streams

  CVSSv3 Score: 5.4 An Improper Access control vulnerability [CWE-284] in FortiSOAR may allow an authenticated attacker with zero permissions to subscribe to websocket streams and topics and to inject broadcast messages to the stream via crafted websocket requests Revised on 2026-09-08 00:00:00
• Fortinet PSIRT Advisories 8 Sep

  Arbitrary process termination from exposed minifilter communication port

  CVSSv3 Score: 5.1 An Unverified Ownership Vulnerability [CWE-283] in FortiClient Windows fortimon3 driver may allow an authenticated attacker to terminate arbitrary processes via an exposed minifilter communication port. Revised on 2026-09-08 00:00:00
• Fortinet PSIRT Advisories 12 Aug

  UI DoS attack

  CVSSv3 Score: 5.3 An Allocation of Resources Without Limits or Throttling vulnerability [CWE-770] in FortiOS may allow an unauthenticated attacker to perform a slow HTTP DoS attack on the web interface via crafted HTTP requests. Revised on 2026-08-12 00:00:00
• Fortinet PSIRT Advisories 12 Aug

  Stack buffer overflow in WAD

  CVSSv3 Score: 5.6 A Stack-based Buffer Overflow vulnerability [CWE-121] in FortiOS explicit proxy may allow an unauthenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands in the context of the WAD daemon via crafted sockets, only if the explicit proxy is configured with Kerberos authentication and SOCKS enabled. Revised on 2026-08-12 00:00:00
• Fortinet PSIRT Advisories 12 Aug

  Server-Side Request Forgery (SSRF)

  CVSSv3 Score: 3.8 A Server-Side request forgery (SSRF) [CWE-918] vulnerability in FortiSIEM GUI may allow an authenticated attacker to send HTTP requests originating from the targeted device via specially crafted HTTP requests Revised on 2026-08-12 00:00:00
• Fortinet PSIRT Advisories 12 Aug

  Heap overflow in kernel driver due to missing size validation

  CVSSv3 Score: 7.3 A buffer copy without checking size of input vulnerability [CWE-120] in FortiClient Windows may allow an unauthenticated attacker in a position to alter or craft DNS responses to the targeted host to execute arbitrary code via malicious packets. Revised on 2026-08-12 00:00:00
• Fortinet PSIRT Advisories 12 Aug

  FGFM Authentication Weakening via CLI Configuration

  CVSSv3 Score: 8.1 An Authentication Bypass Using an Alternate Path or Channel [CWE-288] vulnerability in FortiManager and FortiManager Cloud may allow a remote unauthenticated attacker to impersonate any FortiGate managed by the FortiManager with a specific CLI option set via crafted FGFM requests if the attacker has a valid certificate. Revised on 2026-08-12 00:00:00
• Fortinet PSIRT Advisories 12 Aug

  Content-Encoding WAF Evasion

  CVSSv3 Score: 5.3 An incomplete list of disallowed inputs [CWE-184] in FortiWeb WAF may allow an unauthenticated attacker to bypass policies via specifically crafted requests. Revised on 2026-08-12 00:00:00
• Fortinet PSIRT Advisories 12 Aug

  Broken access control in the RADIUS type admin group

  CVSSv3 Score: 9.8 An Improper Authentication vulnerability [CWE-287] in the FortiWeb Remote Radius Type Admin Authentication configured with specific, non-default settings may allow a remote unauthenticated attacker to login into the Fortiweb GUI/CLI with a random username and password Revised on 2026-08-12 00:00:00
• Fortinet PSIRT Advisories 12 Aug

  HTTP/2 Bomb CVE-2026-49975

  CVSSv3 Score: 5.8 CVE-2026-49975Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67. Revised on 2026-08-19 00:00:00

  CVE-2026-49975
• Fortinet PSIRT Advisories 14 Jul

  Unauthenticated VNC access exposed on all interfaces

  CVSSv3 Score: 8.6 An Exposure of Resource to Wrong Sphere vulnerability [CWE-668] in FortiSandbox may allow an unauthenticated attacker to access the VNC server of VMs performing scanning via network requests. Revised on 2026-07-14 00:00:00
• Fortinet PSIRT Advisories 14 Jul

  Supers override fails to properly override supervisor address

  CVSSv3 Score: 7.5 An Improper Restriction of Communication Channel to Intended Endpoints [CWE-923] vulnerability in FortiSIEM Windows Agent may allow an unauthorized attacker on the same local network to execute arbitrary code via spoofing the supervisors hostname when the Windows device is configured with the 'Supers Override' feature. Revised on 2026-07-14 00:00:00
• Fortinet PSIRT Advisories 14 Jul

  Stack Buffer Overflow in Log Report

  CVSSv3 Score: 6.6 A Stack-based Buffer Overflow vulnerability [CWE-121] in FortiOS, FortiProxy and FortiPAM may allow a privileged authenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands via crafted HTTP requests. Revised on 2026-07-14 00:00:00
• Fortinet PSIRT Advisories 14 Jul

  SSL-VPN Reflected XSS

  CVSSv3 Score: 6.1 An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiOS, FortiProxy, FortiPAM and FortiSwitch-Manager Agentless SSL-VPN may allow an authenticated remote user to execute code or commands via crafted requests. Revised on 2026-07-14 00:00:00
• Fortinet PSIRT Advisories 14 Jul

  Path traversal in CLI command allows deletion of root file system

  CVSSv3 Score: 5.5 An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in FortiOS, FortiPAM, FortiProxy and FortiSwitch Manager may allow a privileged authenticated attacker with physical access to the device to delete the file system via crafted CLI commands. Revised on 2026-07-14 00:00:00
• Fortinet PSIRT Advisories 14 Jul

  Out of bounds read in GUI

  CVSSv3 Score: 7.5 An out of bounds read [CWE-125] vulnerability in FortiAuthenticator may allow a remote unauthenticated attacker to retrieve sensitive information via a specially crafted request. Revised on 2026-07-14 00:00:00
• Fortinet PSIRT Advisories 14 Jul

  Missed certificate verification in AD Connector communication with FortiClient EMS

  CVSSv3 Score: 7.5 An Improper Certificate Validation vulnerability [CWE-295] in FortiClient EMS may allow a remote unauthenticated attacker to impersonate an AD Connector via a valid API Key. Revised on 2026-07-14 00:00:00
• Fortinet PSIRT Advisories 14 Jul

  Header injection in captive portal authentication form

  CVSSv3 Score: 3.1 An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] in FortiOS and FortiProxy captive portal may allow an attacker able to intercept and modify a user's authentication request to inject arbitrary headers via crafted HTTP requests. Revised on 2026-07-14 00:00:00
• Fortinet PSIRT Advisories 14 Jul

  Header injection in Web Filter warning page

  CVSSv3 Score: 3.4 An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] in FortiOS and FortiProxy may allow an attacker in possession of a valid web filter override token to inject arbitrary headers via tricking a user into clicking on a crafted link. Revised on 2026-07-14 00:00:00
• Fortinet PSIRT Advisories 14 Jul

  Cross-Site Scripting in Domain parameter

  CVSSv3 Score: 5.9 An Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability [CWE-80] in FortiSIEM may allow a privileged administrator to execute unauthorized commands via crafted requests. Revised on 2026-07-14 00:00:00
• Fortinet PSIRT Advisories 14 Jul

  Buffer overread in authd and wad daemon

  CVSSv3 Score: 4.3 A buffer over-read vulnerability [CWE-126] in FortiOS, FortiProxy, and FortiSASE may allow an authenticated remote attacker to return a portion of device memory in the redirect response via submitting a specially crafted request. Revised on 2026-07-14 00:00:00
• Fortinet PSIRT Advisories 9 Jun

  Second-Order OS Command Injection via JSON Input on start vnc feature

  CVSSv3 Score: 9.8 An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiSandbox, FortiSandbox Cloud and FortiSandbox PaaS WEB UI may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests. Revised on 2026-06-09 00:00:00
• Fortinet PSIRT Advisories 9 Jun

  Restricted CLI escape using Lua

  CVSSv3 Score: 6.7 An Internal Asset Exposed to Unsafe Debug Access Level or State vulnerability [CWE-1244] in FortiOS and FortiProxy may allow an authenticated admin to execute lua scripts via crafted CLI commands. Revised on 2026-06-09 00:00:00
• Fortinet PSIRT Advisories 9 Jun

  Improper access control in API endpoints

  CVSSv3 Score: 6.5 An improper access control vulnerability [CWE-284] in FortiPortal API endpoints may allow a remote privileged attacker with organization user role to obtain sensitive network configuration data via crafted HTTP requests. Revised on 2026-06-09 00:00:00
• Fortinet PSIRT Advisories 3 Jun

  Linux Kernel vulnerability Dirty Frag

  CVSSv3 Score: 8.8 Linux kernel is impacted by CVE-2026-43284 and CVE-2026-43500 which chained together create the Dirty Frag vulnerability.CVE-2026-43284In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), so later paths that may modify packet data can first make a private copy. The IPv4/IPv6 datagram append paths did not set this flag when splicing pages into UDP skbs. That leaves an ESP…

  CVE-2026-43284, CVE-2026-43500
• Fortinet PSIRT Advisories 10 Feb

  LDAP authentication bypass in Agentless VPN and FSSO

  CVSSv3 Score: 8.1 An Authentication Bypass by Primary Weakness vulnerability [CWE-305] in FortiOS fnbamd may allow an unauthenticated attacker to bypass LDAP authentication of Agentless VPN or FSSO policy, under specific LDAP server configuration. Revised on 2026-07-04 00:00:00
• Fortinet PSIRT Advisories 14 Oct 2025

  Insertion of Sensitive 2FA Information in logs and debug command

  CVSSv3 Score: 2.7 An Insertion of Sensitive Information into Log File vulnerability [CWE-532] in FortiOS may allow an attacker with at least read-only privileges to retrieve sensitive 2FA-related information via observing logs or via diagnose command. Revised on 2026-06-08 00:00:00

Older