Fortinet patches nearly 100 vulnerabilities across its products
Original title: Fortinet Patches Nearly 100 Vulnerabilities
About 17 fixes are critical, including code execution and authentication bypass, with no exploitation stated.
Fortinet published 89 new security advisories covering nearly 100 vulnerabilities. About 17 are critical and can lead to arbitrary code execution, authentication bypass, account takeover, or command execution as super admin, among other impacts. FortiMail received the most critical fixes, followed by FortiAuthenticator, FortiOS, FortiManager, and FortiAnalyzer, with critical updates also for FortiSASE and FortiClient. Fortinet does not say any of the defects are exploited in the wild.
Unconfirmed: Fixed versions are not listed here, and Fortinet does not mention in-the-wild exploitation.
- Nearly 80 additional issues are rated high severity.
- Kevin Joensen says the FortiClient bug requires FortiPAM to be enabled.
- He attributes Fortinet2Shell to a CORS misconfiguration against a local service.
- A victim must visit a malicious website for that FortiClient issue.
- Fortinet links the release volume to AI-assisted product security testing.
Impact: Code execution, authentication bypass, or account takeover
| Product | Affected |
|---|---|
| Fortinet FortiMail | — |
| Fortinet FortiAuthenticator | — |
| Fortinet FortiOS | — |
| Fortinet FortiManager | — |
| Fortinet FortiAnalyzer | — |
| Fortinet FortiSASE | — |
| Fortinet FortiClient | — |
- 1.Prioritize upgrades for products with critical fixes, starting with FortiMail and FortiClient.
- 2.Review Fortinet PSIRT advisories for affected versions and fixed releases.
- Vendors
- Fortinet
- Organizations
- Baldur Security
From the original article
2 min read at securityweek.com
The massive drop comes after the company integrated frontier AI models into its product security testing. The post Fortinet Patches Nearly 100 Vulnerabilities appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.