This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Fortinet fixes 11 vulnerabilities
Fortinet fixes 11 vulnerabilities in various products. The most severe are described below; the remaining ones can be found in the attached links. Products and their fixes: FortiSwitchAXFixed - 1.0.2 [1] FortiManager - 7.0.15, 7.2.11, 7.6.5, 7.4.9, 7.2.11 [2][3][5][7][8][6] FortiAnalyzer - 7.0.15, 7.2.11, 7.6.5, 7.4.9 [3][5][7][8][9][6] FortiSandbox Cloud - 4.4.8, 5.0.5 [4][10] FortiAnalyzer Cloud - 7.0.15, 7.2.11, 7.6.5, 7.4.8 [5][6][8][6] FortiManager Cloud - 7.0.15, 7.2.11, 7.6.5, 7.4.8 [5][6][8][6] FortiAnalyzer-BigData - 7.6.1, 7.4.5 [9]
Allows an unauthenticated remote attacker on an adjacent network, due to a buffer overflow when processing an LLDP packet in FortiSwitchAXFixed, to execute arbitrary code or commands on the affected device [1].
The vulnerability is present in product:
- FortiSwitchAXFixed; >=1.0.0, <=1.0.1
CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
More information:
- CVE-2026-22627 at cve.org, NVD
- CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') at cwe.mitre.org
The vulnerability was publicly disclosed 10. 3. 2026.
Allows an unauthenticated remote attacker, due to a stack-based buffer overflow in the fgtupdates service in FortiManager, to execute unauthorized commands via forged requests. The success of the attack depends on the ability to bypass stack protection mechanisms [2].
The vulnerability is present in product:
- FortiManager; >=7.4.0, <=7.4.2; >=7.2.0, <=7.2.10; =6.4
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2025-54820 at cve.org, NVD
- CWE-121: Stack-based Buffer Overflow at cwe.mitre.org
The vulnerability was publicly disclosed 10. 3. 2026.
Allows an authenticated remote attacker who knows the administrator password, due to an authentication bypass using an alternate path vulnerability in multi-factor authentication in FortiManager and FortiAnalyzer, to bypass MFA checks by sending forged requests [3].
The vulnerability is present in products:
- FortiAnalyzer; >=7.6.0, <=7.6.3; >=7.4.0, <=7.4.7; >=7.2.2, <=7.2.11
- FortiManager; >=7.6.0, <=7.6.3; >=7.4.0, <=7.4.7; >=7.2.2, <=7.2.11
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C
More information:
- CVE-2026-22572 at cve.org, NVD
- CWE-288: Authentication Bypass Using an Alternate Path or Channel at cwe.mitre.org
The vulnerability was publicly disclosed 10. 3. 2026.
Allows an authenticated remote attacker with administrator privileges, due to an OS Command Injection vulnerability in the web interface of FortiSandbox Cloud, to execute unauthorized code or commands via forged HTTP requests [4].
The vulnerability is present in product:
- FortiSandbox Cloud; =5.0.4
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
More information:
- CVE-2026-25836 at cve.org, NVD
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 10. 3. 2026.
Links
- [1] https://fortiguard.fortinet.com/psirt/FG-IR-26-086
- [2] https://fortiguard.fortinet.com/psirt/FG-IR-26-098
- [3] https://fortiguard.fortinet.com/psirt/FG-IR-26-090
- [4] https://fortiguard.fortinet.com/psirt/FG-IR-26-096
- [5] https://fortiguard.fortinet.com/psirt/FG-IR-26-079
- [6] https://fortiguard.fortinet.com/psirt/FG-IR-26-092
- [7] https://fortiguard.fortinet.com/psirt/FG-IR-26-078
- [8] https://fortiguard.fortinet.com/psirt/FG-IR-26-081
- [9] https://fortiguard.fortinet.com/psirt/FG-IR-26-095
- [10] https://fortiguard.fortinet.com/psirt/FG-IR-26-091
By CESNET, z.s.p.o. Michaela Jarošová on 17. 3. 2026.