FortiClient CORS flaw allows website-triggered RCE (CVE-2026-121529)
Fortinet says the CVSS 9.1 bug is not known exploited; fixes are 7.4.8 and 7.2.15, with no virtual patch.
1
Stories per day · 30 days
6 RSS
Relatedfortimanager39fortianalyzer29fortimail19authentication-bypass14fortios14command-injection11path-traversal11psirt10remote-code-execution10fortiauthenticator9sql-injection8cwe-787fortisiem7privilege-escalation7authorization-bypass6fortisandbox6peerstitch6cwe-6395
112 stories, newest first · one card per story
Stories tagged #fortinet
Fortinet patches critical unauthenticated code-execution flaws in management products
CVE-2026-126261 hits listed FortiManager branches; Fortinet reports no known exploitation, with fixes in 7.2.9, 7.4.6, 7.6.8 and 8.0.1.
Fortinet patches critical unauthenticated code-execution flaws in management products
CVE-2026-126170 scores 9.8 on the JSON-RPC API; FGFM and OFTP flaws can also run code before login.
11
FortiManager and FortiAnalyzer API flaw allows file write and delete
A read-only authenticated user can alter filesystem files through crafted HTTP or HTTPS requests; CVSS is 7.3.
FortiMail flaw lets unauthenticated attackers access IBE webmail
Attackers can obtain any IBE recipient session and read or send that user's encrypted mail.
FortiOS and FortiSASE OSPF flaw lets unauthenticated attackers send LSAs
Fortinet rates the CWE-305 weakness 9.3; the notice gives no versions, fix, or exploitation status.
FortiOS RADIUS two-factor flaw accepts an invalid token
A read-only authenticated user can reach the GUI when RADIUS returns Access-Challenge after a bad token; CVSS 5.9.
Unauthenticated FortiMail SQL injection can execute code or commands
Fortinet rates the FortiMail flaw CVSS 9.4 and says crafted requests are enough, with no login required.
FortiAuthenticator flaw may let attackers exhaust resources
Fortinet rates the unauthenticated CWE-770 issue 7.5; the November 10 note gives no versions, fix, or CVE.
FortiMail flaw lets unauthenticated attackers take over IBE accounts
Fortinet rates the IBE account-takeover issue CVSS 9.1; the notice gives no versions, fix, or exploitation status.
Unauthenticated FortiMail path traversal can execute code, CVSS 9.8
FG-IR-26-199 is a CWE-22 flaw; the snippet gives no versions, patch or exploitation status.
Hard-coded password in FortiAuthenticator may bypass checks
An unauthenticated attacker may gain access only in circumstances outside their control; Fortinet scores it 9.0.
FortiManager template injection can grant super admin on FortiGates
Fortinet rates the command-injection path CVSS 8.4; the notice does not name versions, fixes or active attacks.
Unauthenticated FortiManager FGFM flaw allows code execution
An attacker who can reach the FGFM port may run code before the registration password is verified; CVSS 9.0.
FortiMail flaw lets attackers release or delete quarantined mail
An unauthenticated attacker can target arbitrary mailboxes through crafted quarantine release requests, scored CVSS 8.2.
ThreatsDay: Fortinet fixes, PHP2Shell scans, Authenticator token flaw
Fortinet is withholding flaw details until November 10 while Hudson Rock reports 40,573 exposed FortiGate secrets.
Fortinet offers FortiAIGate on Oracle Cloud for AI agent controls
The self-hosted gateway inspects prompts, MCP tool traffic, and responses, and can block or redact 35 data types.
1
Fortinet patches critical FortiOS flaws, details held to November 10
Fixes cover FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator; Fortinet says public diffs will show attackers where to look.
CSO ranks incumbent security vendors adapting to AI threats
Palo Alto’s Prisma AIRS hit $100 million ARR, and the company bought CyberArk for $25 billion.
1
Canadian centre flags Fortinet flaws in six product lines (AV26-1081)
Fixed builds are listed for current branches, while FortiMail 7.2 must move to branch 7.4 or above.
k0t exploits edge firewalls and VPNs, exposing over 70,000 credentials
Group-IB and NyxLab say k0t used FortiWeb and PAN-OS flaws, then remote-access tools and cloud exfiltration, from February to June 2026.
Fortinet schedules critical fixes for FortiOS, FortiManager, and FortiAnalyzer
Minimum fixed builds are set for October 22, while PSIRT advisories and CVE details are due November 10.
PAN-OS and Panorama affected by unpatched PHP2Shell flaws
Palo Alto has no fixed PAN-OS builds yet; Fortinet is still checking 12 products and Cisco 31 products and services.
Fortinet urges urgent patches for FortiOS, FortiManager and FortiAnalyzer
October 22 updates precede November 10 PSIRT advisories; Fortinet reports no active exploitation and lists no CVE IDs.