Search: “FortiAnalyzer”

Uncontrolled Resource Consumption in SNMP

Uninitialized variable flaw (CVSS 5.9) in FortiAnalyzer's SNMP daemon lets remote authenticated attackers cause denial of service via SNMP GETBULK requests.

Fortinet advisory FG-IR-26-172 describes a use of uninitialized variable vulnerability (CWE-457) in the FortiAnalyzer SNMP daemon, scored CVSSv3 5.9. A remote authenticated attacker with user-level permissions can cause a denial of service via SNMP GETBULK requests. The advisory was revised on 2026-09-08.

Fortinet PSIRT·Sep 8, 07:00 UTC · 8d agoAdvisory

Fortinet Patches Critical Vulnerabilities in FortiMonitorOnSight, Chrome Extension

Fortinet patched 10 vulnerabilities including two critical authentication flaws, CVE-2026-84390 (CVSS 9.6) and CVE-2026-84388 (CVSS 9.1), in FortiMonitorOnSight and the FortiPAM Chrome extension.

Fortinet's September patch release fixes CVE-2026-84390, a sensitive-information issue in the FortiMonitorOnSight web portal that lets unauthenticated attackers bypass authentication with forged or reused JWTs. CVE-2026-84388 is an improper authentication flaw in the Fortinet Privileged Access Agent Chrome extension that can allow attackers to proxy a user's browser traffic via a malicious website, requiring upgrades to both FortiPAM 1.9.1/1.8.4 and extension 8.0.1.123+. High-severity information disclosure in FortiSandbox (CVE-2026-26084) and man-in-the-middle risk in the FortiOS/FortiProxy Agentless ZTNA portal (CVE-2026-84393) were also fixed, alongside medium/low issues across FortiManager, FortiAnalyzer, FortiSOAR, FortiClient, FortiSIEM and others. Fortinet did not indicate any of the flaws are being exploited in the wild.

SecurityWeek·Sep 9, 14:33 UTC · 7d agoVulnerabilityCVE-2026-84390CVE-2026-84388CVE-2026-26084+1 CVEs

Workflow session email approval process bypass

Fortinet disclosed an improper access control flaw (CVSS 4.7) in FortiManager allowing administrators to bypass workflow session email approval via crafted HTTP requests.

Fortinet advisory FG-IR-26-171 covers an improper access control vulnerability (CWE-284) in FortiManager, rated CVSSv3 4.7. An administrator can bypass the approval process for workflow sessions via crafted HTTP or HTTPS requests. The advisory was revised on 2026-09-08.

Fortinet PSIRT·Sep 8, 07:00 UTC · 8d agoAdvisory

Heap overflow in kernel driver due to missing size validation

Fortinet fixes a CVSS 7.3 heap overflow in the FortiClient Windows kernel driver enabling code execution via crafted DNS responses.

Fortinet PSIRT advisory FG-IR-26-156, revised 2026-08-12, describes a heap-based buffer overflow (CWE-120, buffer copy without checking input size) in the FortiClient Windows kernel driver, scored CVSSv3 7.3. An unauthenticated attacker positioned to alter or craft DNS responses for a targeted host could execute arbitrary code via malicious packets. No CVE identifier or exploitation status is provided in the advisory text, so administrators should check the full bulletin for affected versions and fixed releases.

Fortinet PSIRT·Aug 12, 07:00 UTC · Aug 12, 2026Advisory

FGFM Authentication Weakening via CLI Configuration

FortiManager FGFM flaw (CVSS 7.3) lets an attacker with a valid certificate impersonate any managed FortiGate under a specific CLI option.

Fortinet advisory FG-IR-26-160 describes an authentication bypass via alternate path (CWE-288) in FortiManager and FortiManager Cloud, scored CVSSv3 7.3. A remote unauthenticated attacker holding a valid certificate can impersonate any FortiGate managed by the affected FortiManager when a specific CLI option is set. The impersonation is performed with crafted FGFM protocol requests. The advisory was revised on 2026-08-12 and does not report active exploitation.

Fortinet PSIRT·Aug 12, 07:00 UTC · Aug 12, 2026Advisory

Arbitrary process termination from exposed minifilter communication port

Fortinet FortiClient Windows fortimon3 driver flaw (CVSS 4.7) lets authenticated attackers terminate arbitrary processes via exposed minifilter communication port.

Fortinet advisory FG-IR-26-165 discloses an unverified ownership vulnerability (CWE-283, CVSSv3 4.7) in the FortiClient Windows fortimon3 minifilter driver. An authenticated attacker can terminate arbitrary processes through an exposed minifilter communication port. The advisory was revised on 2026-09-08.

Fortinet PSIRT·Sep 8, 07:00 UTC · 8d agoAdvisory1

11 Best CSPM Tools Compared (2026): Features & Pricing

CSPM comparison ranks Wiz first for agentless attack-path analysis; notes Ermetic absorbed into Tenable and Lacework into Fortinet FortiCNAPP.

An editorial comparison of eleven CSPM tools ranks Wiz as the agentless attack-path momentum leader, Prisma Cloud as the breadth benchmark, and Orca as the agentless SideScanning pioneer. It highlights consolidation: Ermetic now powers Tenable Cloud Security and Lacework became Fortinet's FortiCNAPP. The guide recommends starting with free tiers from Defender for Cloud, Prowler, and native cloud tools before buying.

GBHackers·Sep 15, 06:37 UTC · 1d agoIndustry1

CISA Warns of Fortinet Heap-based Buffer Overflow Flaw Exploited in Attacks

CISA added actively exploited Fortinet CVE-2025-25249, a critical heap-based buffer overflow in FortiOS, FortiSwitchManager, and FortiSASE, to its KEV catalog.

CVE-2025-25249 is a heap-based buffer overflow (CWE-122/CWE-787) allowing unauthorized code execution by sending specially crafted packets. CISA added it to the Known Exploited Vulnerabilities catalog on September 9, 2026, with a September 12 remediation deadline for federal agencies under BOD 26-04 and mandatory forensic triage of affected environments. Internet-facing Fortinet firewalls and SASE platforms are a likely foothold for credential theft, persistence, and lateral movement; ransomware use is currently listed as unknown.

Cyber Security News·updated Sep 10, 18:57 UTC · 6d ago·first Sep 10, 11:26 UTC · 6d agoExploit / PoC in the wild 6 sourcesCVE-2025-252492

U.S. CISA adds Arista VeloCloud Orchestrator and Fortinet FortiOS flaws to its Known Exploited Vulnerabilities catalog

Security Affairs·Aug 5, 15:24 UTC · Aug 5, 2026Exploit / PoC in the wildCVE-2025-68686CVE-2026-16812

Fortinet Vulnerability Ransomware

Ransomware operators are exploiting a Fortinet vulnerability, per the Infosecurity Magazine headline; article details unavailable.

Infosecurity Magazine's headline indicates ransomware activity tied to a Fortinet vulnerability. The article body was not available, so the specific CVE, affected versions and victim details are unconfirmed.

Infosecurity Magazine·Aug 16, 00:00 UTC · Aug 16, 2026Exploit / PoC in the wild

Open Redirect on FortiSIEM

Fortinet disclosed an open redirect flaw (CVSS 2.8) in FortiSIEM allowing authenticated attackers to redirect users to arbitrary websites via crafted HTTP requests.

Fortinet advisory FG-IR-26-169 covers an open redirect vulnerability (CWE-601) in FortiSIEM, rated CVSSv3 2.8. An authenticated attacker can cause a redirection to any website via specially crafted HTTP requests. The advisory was revised on 2026-09-08.

Fortinet PSIRT·Sep 8, 07:00 UTC · 8d agoAdvisory

Server-Side Request Forgery (SSRF)

Fortinet discloses a low-severity SSRF in the FortiSIEM GUI allowing authenticated attackers to send requests from targeted devices.

Fortinet PSIRT advisory FG-IR-26-159, revised 2026-08-12, describes a server-side request forgery (CWE-918) in the FortiSIEM GUI, scored CVSSv3 3.4. An authenticated attacker can send HTTP requests originating from the targeted device via specially crafted requests, potentially enabling internal network probing. No CVE identifier or exploitation status is included in the advisory text.

Fortinet PSIRT·Aug 12, 07:00 UTC · Aug 12, 2026Advisory

Improper Authentication of FortiPAM Server

Fortinet discloses CVSS 9.1 improper authentication in FortiPAM's Chrome extension allowing unauthenticated attackers to proxy victims' browser traffic.

Fortinet advisory FG-IR-26-168 describes an improper authentication vulnerability (CWE-287) rated 9.1 in the Fortinet Privileged Access Agent Chrome Extension. A remote unauthenticated attacker could proxy a user's browser traffic through attacker-controlled servers if the user visits a malicious website. The advisory was revised on September 8, 2026.

Fortinet PSIRT·Sep 8, 07:00 UTC · 8d agoAdvisory

What the Fortibleed campaign means for organizations running FortiGate firewalls

Help Net Security·Aug 3, 13:19 UTC · Aug 3, 2026Threat actor

Broken access control in the RADIUS type admin group

FortiWeb RADIUS admin authentication flaw (CVSS 8.8) permits remote GUI/CLI login with random credentials under specific non-default settings.

Fortinet advisory FG-IR-26-158 describes an improper authentication flaw (CWE-287) in FortiWeb's Remote RADIUS-type admin authentication, scored CVSSv3 8.8. When the configuration uses specific non-default settings, a remote unauthenticated attacker can log into the FortiWeb GUI or CLI with a random username and password. The advisory was revised on 2026-08-12 and does not state that exploitation has been observed.

Fortinet PSIRT·Aug 12, 07:00 UTC · Aug 12, 2026Advisory

Fortinet security advisory (AV26-023) - Update 1

CISA added Fortinet CVE-2025-25249, a heap-based buffer overflow in the cw_acd daemon, to its KEV catalog; Canadian Cyber Centre urges patching.

The Canadian Centre for Cyber Security updated advisory AV26-023, which relays January 2026 Fortinet advisories covering FortiFone, FortiOS, FortiSASE, FortiSIEM, and FortiSwitchManager. On September 9, 2026, CISA added CVE-2025-25249, a heap-based buffer overflow in the cw_acd daemon, to its Known Exploited Vulnerabilities catalog. Related Fortinet flaws include unauthenticated local configuration access (CVE-2025-47855) and unauthenticated remote command injection (CVE-2025-64155). Administrators should review the advisories and apply available updates.

Canadian Centre for Cyber Security·Sep 9, 19:57 UTC · 7d agoExploit / PoC in the wildCVE-2025-25249CVE-2025-47855CVE-2025-64155

Broken Access control on Websocket streams

Fortinet FortiSOAR access control flaw (CVSS 4.9) lets zero-permission authenticated attackers subscribe to and inject broadcast messages into websocket streams.

Fortinet advisory FG-IR-26-164 discloses an improper access control vulnerability (CWE-284, CVSSv3 4.9) in FortiSOAR. An authenticated attacker with zero permissions can subscribe to websocket streams and topics and inject broadcast messages via crafted websocket requests. The advisory was revised on 2026-09-08.

Fortinet PSIRT·Sep 8, 07:00 UTC · 8d agoAdvisory

JWT used for authentication in web GUI signed with static key

Fortinet warns that FortiMonitorOnSight's web GUI uses JWTs signed with a static key, enabling remote unauthenticated authentication bypass.

Fortinet advisory FG-IR-26-170 discloses a CVSS 9.6 vulnerability (CWE-540, sensitive information in source code) in the FortiMonitorOnSight web portal. The web GUI's JWT authentication tokens are signed with a static key, allowing a remote unauthenticated attacker to bypass authentication via forged or reused JWTs. The advisory was revised on September 8, 2026.

Fortinet PSIRT·Sep 8, 07:00 UTC · 8d agoAdvisory

Hackers Exploit Critical FortiGate Flaw to Deploy AI-Assisted PivotC2 RAT

SOCRadar says attackers exploit FortiGate CVE-2025-25249 to deploy the PivotC2 Node.js RAT, compromising 178 of 30,000 targeted devices and stealing credentials.

SOCRadar's Threat Research Unit reports active exploitation of CVE-2025-25249, a CVSS 9.8 heap-based buffer overflow in the cw_acd daemon of FortiOS and FortiSwitchManager, via crafted CAPWAP requests to UDP port 5246, compromising at least 178 of 30,000 targeted internet-exposed FortiGate devices since July 2026. The campaign deploys PivotC2, a Node.js RAT that provides interactive shells, SOCKS5/HTTP proxying, port forwarding, network scanning, and automated configuration harvesting that decrypts stored FortiGate credentials, including VPN pre-shared keys, SSL-VPN credentials, and LDAP secrets. Russian-language artifacts, AD enumeration, browser credential theft, RDP enablement, and exfiltration of Exchange .pst files to Wasabi S3 point to a Russian-speaking, financially motivated group; two US organizations confirmed full-network intrusions. Fixes include FortiOS 7.6.4/7.4.9/7.2.12/7.0.18+ and FortiSwitchManager 7.2.7/7.0.6+, plus blocking CAPWAP on internet-facing interfaces.

GBHackers·Sep 9, 08:57 UTC · 7d agoMalware in the wildCVE-2025-252492

FortiPAM Chrome Extension Vulnerability Lets Malicious Sites Control Browser Proxy and Record Tabs

Fortinet patched CVE-2026-84388 (CVSS 9.1) in its FortiPAM Chrome extension, letting malicious websites alter proxy settings, open tabs and record sessions.

The Fortinet FortiPAM Chrome extension flaw (CVE-2026-84388, CVSS 9.1) lets attacker-controlled domains be trusted as FortiPAM servers because a webRequest listener adds requested hostnames without verifying the initiator. A second issue exposes the extension's message interface to all URLs and accepts non-JWT tokens without validation, enabling unauthenticated session launches, proxy manipulation, tab control and recording; the consent dialog can also be bypassed via shadow-root clicks. Fortinet issued advisory FG-IR-26-168 after a July 17 report and released a fix on August 1, 2026, with no confirmed exploitation in the wild.

GBHackers·Sep 9, 13:18 UTC · 7d agoVulnerabilityCVE-2026-84388

Hackers Actively Exploiting FortiGate Firewalls to Deploy Custom Node.js Malware

Attackers actively exploit CVE-2025-25249 in FortiGate firewalls to deploy PivotC2, a Node.js RAT that decrypts VPN and admin credentials.

SOCRadar assesses with high confidence that threat actors are actively exploiting CVE-2025-25249, a CVSS 9.8 heap buffer overflow in the cw_acd daemon (CAPWAP, UDP 5246) affecting FortiOS 6.4-7.6.3 and FortiSwitchManager 7.0.x/7.2.x. Attackers deploy fortirun.bin and PivotC2, a Node.js post-exploitation framework that harvests configurations and decrypts SSL-VPN, wireless, and admin credentials using AES-256-CBC and AES-128-GCM. Over 30,000 FortiGate IPs were scanned and 178 devices compromised, including two confirmed full intrusions of US organizations with Exchange mailbox exfiltration to Wasabi storage. STRU attributes the campaign to a Russian-speaking, financially motivated cybercrime operator.

Cyber Security News·Sep 8, 16:50 UTC · 8d agoExploit / PoC in the wildCVE-2025-252491