Fortinet patches nearly 100 vulnerabilities across its products
About 17 fixes are critical, including code execution and authentication bypass, with no exploitation stated.
Stories per day · 30 days
3 RSS
Relatedfortinet14fortimanager7fortianalyzer6fortimail4authentication-bypass3fortiproxy3credential-exposure2denial-of-service2fortiauthenticator2fortigate2fortijump2peerstitch2remote-code-execution2unc58202vpn2active-directory1cl-sta-09541cwe-4151
32 stories, newest first · one card per story
Stories tagged #fortios
Fortinet patches critical unauthenticated code-execution flaws in management products
CVE-2026-126261 hits listed FortiManager branches; Fortinet reports no known exploitation, with fixes in 7.2.9, 7.4.6, 7.6.8 and 8.0.1.
Fortinet patches critical unauthenticated code-execution flaws in management products
CVE-2026-126170 scores 9.8 on the JSON-RPC API; FGFM and OFTP flaws can also run code before login.
11
FortiOS and FortiSASE OSPF flaw lets unauthenticated attackers send LSAs
Fortinet rates the CWE-305 weakness 9.3; the notice gives no versions, fix, or exploitation status.
FortiOS RADIUS two-factor flaw accepts an invalid token
A read-only authenticated user can reach the GUI when RADIUS returns Access-Challenge after a bad token; CVSS 5.9.
FortiBleed 2.0 finds 40,573 cleartext secrets in FortiGate configs
Hudson Rock parsed 1,703 FortiGate configuration reports and 1,689 host identifiers; 975 domain labels were absent from the earlier set.
FortiBleed 2.0 finds 40,573 cleartext secrets in exposed FortiGate configs
The follow-up is stolen configuration files, not a new Fortinet flaw, and the records are not confirmed still valid.
Fortinet patches critical FortiOS flaws, details held to November 10
Fixes cover FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator; Fortinet says public diffs will show attackers where to look.
Canadian centre flags Fortinet flaws in six product lines (AV26-1081)
Fixed builds are listed for current branches, while FortiMail 7.2 must move to branch 7.4 or above.
Fortinet schedules critical fixes for FortiOS, FortiManager, and FortiAnalyzer
Minimum fixed builds are set for October 22, while PSIRT advisories and CVE details are due November 10.
Fortinet urges urgent patches for FortiOS, FortiManager and FortiAnalyzer
October 22 updates precede November 10 PSIRT advisories; Fortinet reports no active exploitation and lists no CVE IDs.
PEERSTITCH malware: How Attackers Compromised 500 Firewalls Through FortiManager
Unit 42 says PEERSTITCH, planted through FortiManager flaws, exposed material for more than 500 firewalls.
9
PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions
Unit 42 says CL-STA-0954 used Fortinet flaws to deploy memory-resident PEERSTITCH against a telecom provider.
13
CISA lists Fortinet path traversal CVE-2025-61624 as exploited
Authenticated admins with read-write rights can write or delete arbitrary files via CLI; the due date is October 19, 2026.
Double free in signal handler
A double-free in FortiOS, FortiProxy, and FortiSwitch lets a local user crash the newcli daemon.
GUI Denial of Service
Fortinet discloses a CVSS 6.7 FortiOS flaw that can crash the HTTPS management interface.
Hackers Allegedly Selling Fortinet FortiGate 1-Day Vulnerability on Underground Forums
An unverified underground listing offers a claimed FortiGate SSL VPN RCE exploit for FortiOS 7.2.x/7.4.x amid ongoing exploitation of known Fortinet flaws.
3
Hackers Exploit FortiGate SSL-VPN Vulnerability to Attack Broadband Provider
Exposed attacker staging server reveals intrusion of Thai broadband provider 3BB via actively exploited FortiGate SSL-VPN flaw CVE-2024-21762.
8
Weekly Cybersecurity Newsletter Bulletin – Microsoft 0-day, FortiOS, PAN-OS Flaw, Revolut Data Breach, and 20+ Stories
Weekly roundup: Microsoft patches 973 flaws including two actively exploited zero-days; FortiOS CAPWAP flaw deploys PivotC2 RAT; PAN-OS root RCE disclosed.
CISA Warns of Fortinet Heap-based Buffer Overflow Flaw Exploited in Attacks
CISA added actively exploited Fortinet CVE-2025-25249, a critical heap-based buffer overflow in FortiOS, FortiSwitchManager, and FortiSASE, to its KEV catalog.
4
CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline
CISA adds actively exploited Cisco, Citrix, and Fortinet edge-device flaws to KEV catalog, ordering federal agencies to patch by September 12, 2026.
Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks
Threat actors exploit Fortinet heap-based buffer overflow CVE-2025-25249 to deploy PivotC2 RAT, infecting 178 devices and exfiltrating data from US targets.
4
Fortinet security advisory (AV26-023) - Update 1
CISA added Fortinet CVE-2025-25249, a heap-based buffer overflow in the cw_acd daemon, to its KEV catalog; Canadian Cyber Centre urges patching.
2
Fortinet security advisory (AV26-898)
Canadian Cyber Centre advisory AV26-898 flags Fortinet vulnerabilities across FortiOS, FortiProxy, FortiPAM, FortiSandbox and FortiMonitorOnSight, urging administrators to apply updates