This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Fortinet fixes 14 vulnerabilities in 8 products

Fortinet fixes 14 vulnerabilities in 8 products. The most severe vulnerabilities are listed below. FortiSIEM - 7.6.0 [1][2] FortiOS - 7.6.9, 8.0.1 [3][4] FortiProxy - 7.6.7 [3] FortiSwitch - 7.6.7 [3] FortiSandbox - 5.2.2, 5.0.7 [5][6][7] FortiAnalyzer - 7.6.5, 7.4.8, 7.2.12, 6.4.0 [8][9] FortiManager - 8.0.1, 7.6.7, 7.4.7, 6.4.0 [8][9][10] FortiMail - 7.6.4, 7.4.6, 7.2.9 [11]

FortiSIEM - path traversal (CVE-2026-106173)
CVSS 9.8 (Critical)

Allows an unauthenticated remote attacker, due to insufficient restriction of the directory path in FortiSIEM, to execute code and commands by sending specially crafted packets. As a temporary fix, access to port 27918 (TCP) can be restricted to trusted IP addresses only [1].

The vulnerability is present in product:

  • FortiSIEM; >=7.5.0, <7.5.1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C

More information:

  • CVE-2026-106173 at cve.org, NVD
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') at cwe.mitre.org

The vulnerability was publicly disclosed 13. 10. 2026.

FortiSandbox - authentication bypass (CVE-2026-107656)
CVSS 9.8 (Critical)

Allows an unauthenticated remote attacker to bypass authentication in the GUI of FortiSandbox using specially crafted HTTP requests [7].

The vulnerability is present in product:

  • FortiSandbox; >=4.4.0, <4.4.10; >=5.0.0, <5.0.7;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 13. 10. 2026.

FortiOS, FortiProxy, FortiSwitch - DoS (CVE-2026-106175)
CVSS 2.3 (Low)

Allows an authenticated local attacker to carry out a DoS attack on the newcli daemon in FortiOS, FortiProxy and FortiSwitch using specially crafted commands [3].

The vulnerability is present in products:

  • FortiOS; >=7.2.0, <7.3.0; >=7.4.0, <7.5.0; >=7.6.0, <7.6.8;
  • FortiProxy; >=7.2.0, <7.3.0; >=7.4.0, <7.5.0; >=7.6.0, <7.6.7;
  • FortiSwitch; >=7.2.0, <7.3.0; >=7.4.0, <7.5.0; >=7.6.0, <7.6.7;

CVSS: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

More information:

The vulnerability was publicly disclosed 13. 10. 2026.

FortiAnalyzer (Cloud), FortiManager (Cloud) - SQL injection (CVE-2025-46773, CVE-2026-23705, CVE-2026-23706, CVE-2026-23707)
CVSS 8.8 (High)

Allows an authenticated remote attacker to carry out an SQL injection attack in FortiAnalyzer and FortiManager by sending specially crafted requests [8].

The vulnerability is present in products:

  • FortiAnalyzer; >=7.2.0, <7.3.0; >=7.4.0, <7.4.8; >=7.6.0, <7.6.5;
  • FortiManager; >=7.2.0, <7.3.0; >=7.4.0, <7.4.7; >=7.6.0, <7.6.5;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 13. 10. 2026.

FortiMail - SQL injection (CVE-2025-57739)
CVSS 8.8 (High)

Allows an authenticated remote attacker to carry out an SQL injection attack in FortiMail by sending specially crafted HTTP requests [11].

The vulnerability is present in product:

  • FortiMail; >=7.2.0, <7.2.9; >=7.4.0, <7.4.6; >=7.6.0, <7.6.4;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

  • CVE-2025-57739 at cve.org, NVD
  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 13. 10. 2026.

By CESNET, z.s.p.o. Martin Krajči on 14. 10. 2026.

CESNET, z.s.p.o. Logo