Cisco to publish November 4 advisories for ISE, UCS, and UCM
Fixed releases will be named then, and PSIRT plans no further hardening advisories in 2026.
Stories per day · 30 days
2 RSS
Relatedfortinet10fortisandbox3authentication-bypass2cisco2cwe-892denial-of-service2fortimanager2fortisiem2rce2sql-injection2advance-notification1authenticated1broken-authorization1command-injection1cwe-221cwe-2481cwe-2881cwe-3211
18 stories, newest first · one card per story
Stories tagged #psirt
PHP core OOM handling can lead to RCE, Fortinet PSIRT says
CVE-2026-109618 is scored CVSS 9.8; the notice, also naming CVE-2026-109619, was revised on October 21.
Cisco Advance Notification for Publication of October 21, 2026, Security Advisories
Cisco will publish October 21, 2026 advisories and fixes for Expressway, IOS XR, Secure Client, Snort, and UC products.
Arbitrary file write in grpc phQueryMaster
Fortinet warns of a CVSS 9.4 FortiSIEM path traversal letting unauthenticated attackers run commands.
Improper access control and session management in the web management interface
Fortinet warns of a CVSS 9.6 unauthenticated authentication bypass in the FortiSandbox GUI.
Multiple Arbitrary File Read/Write via SQL Injection
Fortinet says SQL injection in FortiAnalyzer and FortiManager lets low-privileged users run arbitrary commands.
Fabric API Authentication bypass
A hard-coded key in the FortiSandbox API lets unauthenticated attackers reach some endpoints.
Improper limitation of a pathname to a restricted directory
Fortinet warns of a CVSS 9.8 path traversal that lets unauthenticated attackers write arbitrary files, with in-the-wild exploitation reported.
2
Cisco Advance Notification for Publication of October 7, 2026, Security Advisories
Cisco will publish October 7 security advisories and hardening fixes for NX-OS, Meraki, APIC, and related products.
Cisco Advance Notification for Publication of September 16, 2026, Security Advisories
Cisco will publish security advisories with fixed software on September 16, 2026, covering BroadWorks, ISE, Nexus Dashboard, ASA, FMC, FTD and ThousandEyes.
Workflow session email approval process bypass
Fortinet disclosed an improper access control flaw (CVSS 4.7) in FortiManager allowing administrators to bypass workflow session email approval via crafted HTTP requests.
Uncontrolled Resource Consumption in SNMP
Uninitialized variable flaw (CVSS 5.9) in FortiAnalyzer's SNMP daemon lets remote authenticated attackers cause denial of service via SNMP GETBULK requests.
ZTNA Portal Improper Certificate Validation
Fortinet fixed an improper certificate validation flaw (CVSS 7.3) in FortiOS and FortiProxy Agentless ZTNA portal enabling unauthenticated man-in-the-middle attacks on backend traffic.
Null Pointer Dereference in Log Report
Fortinet patched a low-severity null pointer dereference (CVSS 2.5) in FortiOS, FortiProxy, and FortiPAM that lets authenticated attackers crash the httpsd daemon.
JWT used for authentication in web GUI signed with static key
Fortinet warns that FortiMonitorOnSight's web GUI uses JWTs signed with a static key, enabling remote unauthenticated authentication bypass.
Open Redirect on FortiSIEM
Fortinet disclosed an open redirect flaw (CVSS 2.8) in FortiSIEM allowing authenticated attackers to redirect users to arbitrary websites via crafted HTTP requests.
Improper Authentication of FortiPAM Server
Fortinet discloses CVSS 9.1 improper authentication in FortiPAM's Chrome extension allowing unauthenticated attackers to proxy victims' browser traffic.
Unauthenticated Control of NAT Rules Leading to Exposure of Sensitive Information
Fortinet fixed an improper access control flaw (CVSS 8.9) in FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS letting unauthenticated attackers access sensitive information.