https://vulnfeed.it Fortinet security vulnerabilities — vulnfeed.it en-us Tue, 04 Aug 2026 17:55:03 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-127 CVSSv3 Score: 6.7 An out-of-bounds write vulnerability [CWE-787] in FortiWeb CGI daemon may allow a remote privileged attacker to execute arbitrary code or command via crafted HTTP requests. Revised on 2026-04-15 00:00:00 Wed, 15 Apr 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-127 https://fortiguard.fortinet.com/psirt/FG-IR-26-139 CVSSv3 Score: 7.8 CVE-2026-31431In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly. Revised on 2026-05-13 00:00:00 Wed, 13 May 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-139 https://fortiguard.fortinet.com/psirt/FG-IR-26-144 CVSSv3 Score: 7.9 Linux kernel is impacted by CVE-2026-43284 and CVE-2026-43500 which chained together create the Dirty Frag vulnerability.CVE-2026-43284In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), so later paths that may modify packet data can first make a private copy. The IPv4/IPv Wed, 03 Jun 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-144 https://fortiguard.fortinet.com/psirt/FG-IR-25-545 CVSSv3 Score: 1.8 An Improper Privilege Management vulnerability [CWE-269] in FortiOS, FortiProxy and FortiPAM may allow an authenticated administrator to bypass the trusted host policy via crafted CLI command. Revised on 2026-05-27 00:00:00 Tue, 18 Nov 2025 08:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-25-545 https://fortiguard.fortinet.com/psirt/FG-IR-24-452 CVSSv3 Score: 2.6 An Insertion of Sensitive Information into Log File vulnerability [CWE-532] in FortiOS may allow an attacker with at least read-only privileges to retrieve sensitive 2FA-related information via observing logs or via diagnose command. Revised on 2026-06-08 00:00:00 Tue, 14 Oct 2025 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-24-452 https://fortiguard.fortinet.com/psirt/FG-IR-26-154 CVSSv3 Score: 4.1 A buffer over-read vulnerability [CWE-126] in FortiOS, FortiProxy, and FortiSASE may allow an authenticated remote attacker to return a portion of device memory in the redirect response via submitting a specially crafted request. Revised on 2026-07-14 00:00:00 Tue, 14 Jul 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-154 https://fortiguard.fortinet.com/psirt/FG-IR-26-149 CVSSv3 Score: 5.3 An Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability [CWE-80] in FortiSIEM may allow a privileged administrator to execute unauthorized commands via crafted requests. Revised on 2026-07-14 00:00:00 Tue, 14 Jul 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-149 https://fortiguard.fortinet.com/psirt/FG-IR-26-152 CVSSv3 Score: 3.4 An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] in FortiOS and FortiProxy may allow an attacker in possession of a valid web filter override token to inject arbitrary headers via tricking a user into clicking on a crafted link. Revised on 2026-07-14 00:00:00 Tue, 14 Jul 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-152 https://fortiguard.fortinet.com/psirt/FG-IR-26-153 CVSSv3 Score: 3.1 An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] in FortiOS and FortiProxy captive portal may allow an attacker able to intercept and modify a user's authentication request to inject arbitrary headers via crafted HTTP requests. Revised on 2026-07-14 00:00:00 Tue, 14 Jul 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-153 https://fortiguard.fortinet.com/psirt/FG-IR-26-147 CVSSv3 Score: 6.7 An Improper Certificate Validation vulnerability [CWE-295] in FortiClient EMS may allow a remote unauthenticated attacker to impersonate an AD Connector via a valid API Key. Revised on 2026-07-14 00:00:00 Tue, 14 Jul 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-147 https://fortiguard.fortinet.com/psirt/FG-IR-26-146 CVSSv3 Score: 7.0 An out of bounds read [CWE-125] vulnerability in FortiAuthenticator may allow a remote unauthenticated attacker to retrieve sensitive information via a specially crafted request. Revised on 2026-07-14 00:00:00 Tue, 14 Jul 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-146 https://fortiguard.fortinet.com/psirt/FG-IR-26-151 CVSSv3 Score: 5.0 An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in FortiOS, FortiPAM, FortiProxy and FortiSwitch Manager may allow a privileged authenticated attacker with physical access to the device to delete the file system via crafted CLI commands. Revised on 2026-07-14 00:00:00 Tue, 14 Jul 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-151 https://fortiguard.fortinet.com/psirt/FG-IR-26-150 CVSSv3 Score: 6.1 An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiOS, FortiProxy, FortiPAM and FortiSwitch-Manager Agentless SSL-VPN may allow an authenticated remote user to execute code or commands via crafted requests. Revised on 2026-07-14 00:00:00 Tue, 14 Jul 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-150 https://fortiguard.fortinet.com/psirt/FG-IR-26-148 CVSSv3 Score: 5.9 A Stack-based Buffer Overflow vulnerability [CWE-121] in FortiOS, FortiProxy and FortiPAM may allow a privileged authenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands via crafted HTTP requests. Revised on 2026-07-14 00:00:00 Tue, 14 Jul 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-148 https://fortiguard.fortinet.com/psirt/FG-IR-26-155 CVSSv3 Score: 6.9 An Improper Restriction of Communication Channel to Intended Endpoints [CWE-923] vulnerability in FortiSIEM Windows Agent may allow an unauthorized attacker on the same local network to execute arbitrary code via spoofing the supervisors hostname when the Windows device is configured with the 'Supers Override' feature. Revised on 2026-07-14 00:00:00 Tue, 14 Jul 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-155 https://fortiguard.fortinet.com/psirt/FG-IR-26-145 CVSSv3 Score: 7.7 An Exposure of Resource to Wrong Sphere vulnerability [CWE-668] in FortiSandbox may allow an unauthenticated attacker to access the VNC server of VMs performing scanning via network requests. Revised on 2026-07-14 00:00:00 Tue, 14 Jul 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-145 https://fortiguard.fortinet.com/psirt/FG-IR-26-101 CVSSv3 Score: 6.7 An Improper authentication vulnerability [CWE-287] in FortiSOAR web GUI may allow an unauthenticated attacker to bypass authentication via replaying captured 2FA request. The attack requires being able to intercept and decrypt authentication traffic and precise timing to replay the request before token expiration. Revised on 2026-04-14 00:00:00 Tue, 14 Apr 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-101 https://fortiguard.fortinet.com/psirt/FG-IR-26-115 CVSSv3 Score: 6.2 An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in FortiSandbox, FortiSandbox Cloud, FortiSandbox PaaS and FortiSandbox Cloud WEB UI may allow a privileged attacker with super-admin profile and CLI access to delete an arbitrary directory via HTTP crafted requests. Revised on 2026-04-14 00:00:00 Tue, 14 Apr 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-115 https://fortiguard.fortinet.com/psirt/FG-IR-26-126 On March 31, 2026, the Axios npm package was compromised via a maintainer account takeover. Two malicious versions were published - axios@1.14.1 and axios@0.30.4 - which introduced a hidden dependency (plain-crypto-js@4.2.1) able to execute a post‑install script deploying a cross‑platform Remote Access Trojan (RAT) on Windows, macOS, and Linux systems. Revised on 2026-04-14 00:00:00 Tue, 14 Apr 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-126 https://fortiguard.fortinet.com/psirt/FG-IR-26-105 CVSSv3 Score: 4.1 A Storing Passwords in a Recoverable Format vulnerability [CWE-257] in FortiSOAR may allow an authenticated remote attacker to retrieve Service account password via server address modification in LDAP configuration. Revised on 2026-04-14 00:00:00 Tue, 14 Apr 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-105 https://fortiguard.fortinet.com/psirt/FG-IR-26-104 CVSSv3 Score: 4.1 A Storing Passwords in a Recoverable Format vulnerability [CWE-257] in FortiSOAR may allow an authenticated remote attacker to retrieve passwords for multiple installed connectors via server address modification in connector configuration. Revised on 2026-04-14 00:00:00 Tue, 14 Apr 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-104 https://fortiguard.fortinet.com/psirt/FG-IR-26-106 CVSSv3 Score: 6.2 A Cleartext Transmission of Sensitive Information vulnerability [CWE-319] in FortiSOAR may allow an authenticated attacker to view cleartext password in response for Secure Message Exchange and Radius queries, if configured Revised on 2026-04-14 00:00:00 Tue, 14 Apr 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-106 https://fortiguard.fortinet.com/psirt/FG-IR-26-113 CVSSv3 Score: 2.5 An Insufficiently protected credentials vulnerability [CWE-522] in FortiSanbox and FortiSanbox PaaS GUI may allow an authenticated administrator to read LDAP server credentials via client-side inspection. Revised on 2026-04-14 00:00:00 Tue, 14 Apr 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-113 https://fortiguard.fortinet.com/psirt/FG-IR-26-107 CVSSv3 Score: 5.2 A use of hard-coded cryptographic key vulnerability [CWE 321] in FortiClientEMS may allow an attacker in possession of an encrypted dump of the database to decrypt it. Revised on 2026-04-14 00:00:00 Tue, 14 Apr 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-107 https://fortiguard.fortinet.com/psirt/FG-IR-26-121 CVSSv3 Score: 7.3 A heap-based buffer overflow vulnerability [CWE-122] in FortiAnalyzer Cloud oftpd daemon may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests. Successful exploitation would require a large amount of effort in preparation because of ASLR and network segmentation Revised on 2026-04-14 00:00:00 Tue, 14 Apr 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-121 https://fortiguard.fortinet.com/psirt/FG-IR-26-108 CVSSv3 Score: 4.4 An Integer Overflow or Wraparound vulnerability [CWE-190] in FortiWeb may allow a privileged authenticated attacker to perform a denial of service of the system via crafted HTTP requests. Revised on 2026-04-14 00:00:00 Tue, 14 Apr 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-108 https://fortiguard.fortinet.com/psirt/FG-IR-26-125 CVSSv3 Score: 6.2 A missing authentication for critical function vulnerability [CWE-306] in FortiOS and FortiSwitchManager CAPWAP daemon may allow a local unauthenticated attacker on the same local IP subnet to write device configuration via specially crafted requests. To be successful, this attack requires the targeted FortiGate device to run a specific, non default configuration. Revised on 2026-04-14 00:00:00 Tue, 14 Apr 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-125 https://fortiguard.fortinet.com/psirt/FG-IR-26-114 CVSSv3 Score: 6.2 Multiple Relative Path Traversal vulnerabilities [CWE-23] in FortiWeb may allow a local privileged attacker to execute unauthorized code on the underlying system via crafted CLI commands. Revised on 2026-04-14 00:00:00 Tue, 14 Apr 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-114 https://fortiguard.fortinet.com/psirt/FG-IR-26-102 CVSSv3 Score: 7.1 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiClientEMS may allow an authenticated attacker to run arbitrary SQL queries on the database via sending crafted requests. Revised on 2026-04-14 00:00:00 Tue, 14 Apr 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-102 https://fortiguard.fortinet.com/psirt/FG-IR-26-110 CVSSv3 Score: 4.3 An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiSandbox and FortiSandbox Cloud may allow a privileged attacker to perform a stored XSS attack via crafted HTTP requests. Revised on 2026-04-14 00:00:00 Tue, 14 Apr 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-110 https://fortiguard.fortinet.com/psirt/FG-IR-26-100 CVSSv3 Score: 9.1 An Improper Neutralization of Special Elements used in an OS Command ('OS command injection') vulnerability [CWE-78] in FortiSandbox may allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests. Revised on 2026-04-14 00:00:00 Tue, 14 Apr 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-100 https://fortiguard.fortinet.com/psirt/FG-IR-26-118 CVSSv3 Score: 2.2 An URL Redirection to Untrusted Site ('Open Redirect') vulnerability [CWE-601] in FortiNAC-F may allow a remote privileged attacker with system administrator role to redirect users to an arbitrary website via crafted CSV file. Revised on 2026-04-14 00:00:00 Tue, 14 Apr 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-118 https://fortiguard.fortinet.com/psirt/FG-IR-26-122 CVSSv3 Score: 5.4 An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] in the command line interpreter of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager may allow a privileged attacker to achieve arbitrary write or delete files via specifically crafted arguments to existing commands. Revised on 2026-04-14 00:00:00 Tue, 14 Apr 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-122 https://fortiguard.fortinet.com/psirt/FG-IR-26-138 CVSSv3 Score: 4.0 An Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability [CWE-88] in FortiDeceptor WEB UI may allow an authenticated attacker with at least read-only admin permission to read log files via HTTP crafted requests. Revised on 2026-05-12 00:00:00 Tue, 12 May 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-138 https://fortiguard.fortinet.com/psirt/FG-IR-26-131 CVSSv3 Score: 6.1 An improper neutralization of special elements used in an OS command ("OS Command Injection") vulnerability [CWE-78] in FortiAP, FortiAP-U & FortiAP-W2 CLI may allow an authenticated privileged attacker to execute unauthorized code or commands via crafted CLI requests. Revised on 2026-05-12 00:00:00 Tue, 12 May 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-131 https://fortiguard.fortinet.com/psirt/FG-IR-26-137 CVSSv3 Score: 5.2 A use of potentially Dangerous Function vulnerability [CWE-676] in FortiAnalyzer and FortiManager API may allow an authenticated attacker to cause a system hang via multiple specially crafted HTTP requests causing crashes. This happens if internal locks are aligned, which is out of control of the attacker. Revised on 2026-05-12 00:00:00 Tue, 12 May 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-137 https://fortiguard.fortinet.com/psirt/FG-IR-26-129 CVSSv3 Score: 2.1 A Missing Authorization [CWE-862] in FortiClient Windows may allow an authenticated local attacker to decrypt a currently logged in users VPN password via use of an unprotected DLL function. Revised on 2026-05-12 00:00:00 Tue, 12 May 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-129 https://fortiguard.fortinet.com/psirt/FG-IR-26-128 CVSSv3 Score: 9.1 An Improper Access Control vulnerability [CWE-284] in FortiAuthenticator may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests. Revised on 2026-05-12 00:00:00 Tue, 12 May 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-128 https://fortiguard.fortinet.com/psirt/FG-IR-26-136 CVSSv3 Score: 9.1 A missing authorization vulnerability [CWE-862] in FortiSandbox, FortiSandbox Cloud and FortiSandbox PaaS WEB UI may allow an unauthenticated attacker to execute unauthorized code or commands via HTTP requests. Revised on 2026-05-12 00:00:00 Tue, 12 May 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-136 https://fortiguard.fortinet.com/psirt/FG-IR-26-133 CVSSv3 Score: 6.5 An OS command injection vulnerabtility [CWE-78] in FortiAP and FortiAP-W2 cli may allow an authenticated attacker to execute unauthorized code or commands via a specifically crafted cli command. Revised on 2026-05-12 00:00:00 Tue, 12 May 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-133 https://fortiguard.fortinet.com/psirt/FG-IR-26-130 CVSSv3 Score: 5.0 An improper export of Android application components [CWE-926] in FortiTokenAndroid may allow other applications on the device to read the OTP code via an exported Content Provider URI. Revised on 2026-05-12 00:00:00 Tue, 12 May 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-130 https://fortiguard.fortinet.com/psirt/FG-IR-26-123 CVSSv3 Score: 8.3 An Out-Of-Bounds Write vulnerability [CWE-787] in FortiOS capwap daemon may allow an attacker controlling an authenticated FortiAP FortiExtender or FortiSwitch to gain execution privileges on the FortiGate device Revised on 2026-05-12 00:00:00 Tue, 12 May 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-123 https://fortiguard.fortinet.com/psirt/FG-IR-26-132 CVSSv3 Score: 6.3 An improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiMail may allow an authenticated privileged attacker to execute unauthorized code or commands via specifically crafted HTTP or HTTPS requests. Revised on 2026-05-12 00:00:00 Tue, 12 May 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-132 https://fortiguard.fortinet.com/psirt/FG-IR-26-134 CVSSv3 Score: 5.1 An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability [CWE-89] in FortiNDR may allow an authenticated attacker to execute arbitrary SQL commands on selected databases and tables via specifically crafted HTTP requests. Revised on 2026-05-12 00:00:00 Tue, 12 May 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-134 https://fortiguard.fortinet.com/psirt/FG-IR-25-1052 CVSSv3 Score: 7.5 An Authentication Bypass by Primary Weakness vulnerability [CWE-305] in FortiOS fnbamd may allow an unauthenticated attacker to bypass LDAP authentication of Agentless VPN or FSSO policy, under specific LDAP server configuration. Revised on 2026-07-04 00:00:00 Tue, 10 Feb 2026 08:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-25-1052 https://fortiguard.fortinet.com/psirt/FG-IR-26-140 CVSSv3 Score: 6.2 An improper access control vulnerability [CWE-284] in FortiPortal API endpoints may allow a remote privileged attacker with organization user role to obtain sensitive network configuration data via crafted HTTP requests. Revised on 2026-06-09 00:00:00 Tue, 09 Jun 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-140 https://fortiguard.fortinet.com/psirt/FG-IR-26-143 CVSSv3 Score: 6.0 An Internal Asset Exposed to Unsafe Debug Access Level or State vulnerability [CWE-1244] in FortiOS and FortiProxy may allow an authenticated admin to execute lua scripts via crafted CLI commands. Revised on 2026-06-09 00:00:00 Tue, 09 Jun 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-143 https://fortiguard.fortinet.com/psirt/FG-IR-26-141 CVSSv3 Score: 9.1 An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiSandbox, FortiSandbox Cloud and FortiSandbox PaaS WEB UI may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests. Revised on 2026-06-09 00:00:00 Tue, 09 Jun 2026 07:00:00 +0000 https://fortiguard.fortinet.com/psirt/FG-IR-26-141