Fortinet security advisory (AV26-1037)
Canada's Cyber Centre urges patches for file-write and SQL-injection flaws across several Fortinet products.
On October 13, 2026, the Canadian Centre for Cyber Security issued advisory AV26-1037 for multiple Fortinet products, including FortiAnalyzer, FortiManager, FortiMail, FortiSIEM, and FortiSandbox. Cited issues include arbitrary file read/write via SQL injection, an arbitrary file write in gRPC, SQL command injection in phQueryMaster webmail, and improper access control and session management in the web interface. Affected builds are those before listed fixed versions such as FortiManager 7.6.5/7.4.7 and FortiMail 7.6.4/7.4.6/7.2.9. The notice does not name CVEs or report active exploitation and points administrators to Fortinet PSIRT updates.
- Advisory AV26-1037 covers FortiAnalyzer, FortiManager, FortiMail, FortiSIEM, and FortiSandbox.
- Issues include SQL injection, arbitrary file read/write, and weak web-session controls.
- No exploitation or CVE identifiers are stated; administrators are told to patch.
Full article138 words · extracted from cyber.gc.ca · click to collapse
Serial Number: AV26-1037
Date: October 13, 2026
As of October 13, 2026, Fortinet is affected by vulnerabilities in the following products:
- FortiAnalyzer
- Prior to 7.6.5
- Prior to 7.4.8
- Prior to 7.6.5
- FortiAnalyzer Cloud
- Prior to 7.6.5
- Prior to 7.4.8
- Prior to 7.2.12
- FortiManager
- Prior to 7.6.5
- Prior to 7.4.7
- FortiManager Cloud
- Prior to 7.6.5
- FortiMail
- Prior to 7.6.4
- Prior to 7.4.6
- Prior to 7.2.9
- FortiSIEM
- Prior to 7.5.1
- FortiSandbox
- Prior to 4.4.10
- Prior to 5.0.7
- FortiSandbox PaaS
- 4.4 all versions
- Versions prior to 5.0.7
The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
Text extracted automatically; images, tables and formatting may be missing. Original: https://cyber.gc.ca/en/alerts-advisories/fortinet-security-advisory-av26-1037