This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Fortinet fixes 8 vulnerabilities in various products

Fortinet fixes 8 vulnerabilities in various products. The most severe ones are described below; the remaining ones can be found in the attached links. Individual products and their fixed versions: FortiAuthenticator - 6.6.7 [1] FortiClientWindows - 7.4.5, 7.2.13 [2] FortiOS - 7.6.5, 7.4.10 [3][4][5][6][7] FortiSandbox - 5.0.2, 4.4.8 [8]

FortiSandbox - XSS (CVE-2025-52436)
CVSS 8.8 (High)

Allows an unauthenticated remote attacker to carry out an XSS attack in FortiSandbox [8].

The vulnerability is present in product:

  • FortiSandbox; >=4.0, <4.4.8; >=5.0.0, <5.0.2;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

More information:

  • CVE-2025-52436 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 10. 2. 2026.

FortiOS - LDAP authentication bypass (CVE-2026-22153)
CVSS 8.1 (High)

Allows an unauthenticated remote attacker to bypass authentication in Agentless VPN or FSSO (Fortinet Single Sign-On) under certain conditions, due to a logic error in the FortiOS component (fnbamd). The vulnerability is exploitable if the remote LDAP server configuration allows unauthenticated queries (unauthenticated bind). If an immediate update to a fixed version is not possible, it is recommended to disable this configuration as a temporary risk mitigation. Detailed information on the temporary workaround can be found at [4].

The vulnerability is present in product:

  • FortiOS; >=7.6.0, <7.6.5;

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 10. 2. 2026.

FortiAuthenticator - unauthorized data modification (CVE-2026-21743)
CVSS 7.2 (High)

Allows an authenticated remote attacker with read-only permissions to modify local user accounts without authorization by uploading specific files to an unprotected endpoint in FortiAuthenticator [1].

The vulnerability is present in product:

  • FortiAuthenticator; >=6.3.0, <6.6.7;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 10. 2. 2026.

By CESNET, z.s.p.o. Michaela Ručková on 16. 2. 2026.

CESNET, z.s.p.o. Logo