This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Fortinet fixes 27 vulnerabilities

Fortinet fixes 27 vulnerabilities in various products. The most severe of them are described below. Fixed versions of individual products: FortiAnalyzer [1][2]- 7.6.5, 7.4.9 FortiAnalyzer Cloud [1][2][3] - 7.6.5, 7.4.9 FortiClientEMS [4][5] - 7.4.6, 7.2.13 FortiDDoS-F [6] - 7.2.3 FortiManager [1][2] - 7.6.5, 7.4.9 FortiManager Cloud [1][2][3] - 7.6.5, 7.4.9 FortiNAC-F [7] - 7.6.6 FortiNDR [8] - 7.6.1, 7.4.9 FortiOS [9][10] - 7.6.5, 7.4.10 FortiPAM [10] - 1.7.1 FortiProxy [10] - 7.6.5, 7.4.12 FortiSandbox [11][12][13][14][15][16] - 5.0.6, 4.4.9 FortiSandbox Cloud [13] - fixed in the cloud FortiSandbox PaaS [13][14][15][16] - 5.0.6, 4.4.9 FortiSOAR PaaS - 7.6.5, 7.5.3 [17][18][19][20][21][22] / FortiSOAR File Content Extraction Connector Version 1.3.1 [23] FortiSOAR on-premise - 7.6.5, 7.5.3 [17][18][19][20][21][22] / FortiSOAR File Content Extraction Connector Version 1.3.1 [23] FortiSwitchManager [10] - 7.2.8, 7.0.7 FortiVoice [8] - 7.0.2 FortiWeb [24][25][26] - 8.0.4, 7.6.7

FortiSandbox - privilege escalation (CVE-2026-39813)
CVSS 9.8 (Critical)

An unauthenticated remote attacker can bypass authentication and elevate their privileges in FortiSandbox by sending specially crafted HTTP requests [11].

The vulnerability is present in product:

  • FortiSandbox; >=4.4.0 , <=4.4.8; >=5.0.0, <=5.0.5;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 14. 4. 2026.

FortiSandbox - OS command execution (CVE-2026-39808)
CVSS 9.8 (Critical)

An unauthenticated remote attacker can execute operating system commands by sending specially crafted HTTP requests to a FortiSandbox API endpoint [27].

The vulnerability is present in product:

  • FortiSandbox; >=4.4.0, <=4.4.8;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

  • CVE-2026-39808 at cve.org, NVD
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 14. 4. 2026.

FortiDDoS-F - command execution (CVE-2026-39815)
CVSS 8.8 (High)

An authenticated remote attacker can execute arbitrary commands by sending specially crafted HTTP requests to FortiDDoS-F [9].

The vulnerability is present in product:

  • FortiDDoS-F; >=7.2.1, <=7.2.2;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

  • CVE-2026-39815 at cve.org, NVD
  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 14. 4. 2026.

FortiAnalyzer Cloud, FortiManager Cloud - command execution, RCE (CVE-2026-22828)
CVSS 8.1 (High)

An unauthenticated remote attacker can, under certain conditions, execute arbitrary commands or code due to a stack overflow in the oftpd daemon of FortiAnalyzer Cloud and FortiManager Cloud. The real-world exploitability of the vulnerability is in practice significantly limited by the cloud architecture [28].

The vulnerability is present in products:

  • FortiAnalyzer Cloud; >=7.6.2, <=7.6.4;
  • FortiManager Cloud >=7.6.2, <=7.6.4;

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 14. 4. 2026.

By CESNET, z.s.p.o. Michaela Ručková on 7. 5. 2026.

CESNET, z.s.p.o. Logo