Fortinet security advisory (AV26-1037)
Canada's Cyber Centre urges patches for file-write and SQL-injection flaws across several Fortinet products.
On October 13, 2026, the Canadian Centre for Cyber Security issued advisory AV26-1037 for multiple Fortinet products, including FortiAnalyzer, FortiManager, FortiMail, FortiSIEM, and FortiSandbox. Cited issues include arbitrary file read/write via SQL injection, an arbitrary file write in gRPC, SQL command injection in phQueryMaster webmail, and improper access control and session management in the web interface. Affected builds are those before listed fixed versions such as FortiManager 7.6.5/7.4.7 and FortiMail 7.6.4/7.4.6/7.2.9. The notice does not name CVEs or report active exploitation and points administrators to Fortinet PSIRT updates.