This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Fortinet fixes 11 vulnerabilities in various products

Fortinet fixes 11 vulnerabilities in various products. The most severe of them are listed below. The advisory also includes the vulnerability CVE-2026-31431 (Copy Fail), which we have reported on previously. Fortinet is currently investigating its possible impact on its products, and so far it has not been confirmed in any of them [12]. Individual products and their fixed versions: FortiNDR: 7.6.3, 7.4.10 [1] FortiMail: 7.6.4, 7.4.6, 7.2.9 [2] FortiOS: 7.6.4, 7.4.9, 7.2.12 [3] FortiTokenAndroid: 6.4.0 [4] FortiAP: 7.6.3, 7.4.6 [5][10] FortiAP-U: 7.0.6 [10] FortiAP-W2: 7.4.5, 7.2.6 [5][10] FortiSandbox: 5.0.2, 4.4.9 [6] FortiSandbox Cloud: 5.0.6 [6] FortiSandbox PaaS: 5.0.2, 4.4.9 [6] FortiAuthenticator: 8.0.3, 6.6.9, 6.5.7 [7] FortiClientWindows: 7.4.3 [8] FortiAnalyzer: 7.6.5, 7.4.9 [9] FortiManager: 7.6.5, 7.4.9 [9] FortiDeceptor: 6.3.0, 6.2.0, 6.1.0 [11]

FortiSandbox, FortiSandbox Cloud and FortiSandbox PaaS - RCE (CVE-2026-26083)
CVSS 9.8 (Critical)

An unauthenticated remote attacker is able to execute arbitrary commands in FortiSandbox, FortiSandbox Cloud and FortiSandbox PaaS via specially crafted HTTP requests directed at the web interface [6].

The vulnerability is present in products:

  • FortiSandbox; >= 4.4.0, < 4.4.9; >= 5.0.0, < 5.0.2
  • FortiSandbox Cloud; >= 23.0.0; >= 24.0.0; >= 5.0.2, < 5.0.6
  • FortiSandbox PaaS;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

More information:

The vulnerability was publicly disclosed 12. 5. 2026.

FortiAuthenticator - RCE (CVE-2026-44277)
CVSS 9.8 (Critical)

An unauthenticated remote attacker is able to execute arbitrary code in FortiAuthenticator by sending specially crafted requests to API endpoints, due to improper access control [7].

The vulnerability is present in product:

  • FortiAuthenticator; >= 8.0.0, < 8.0.3; >= 6.6.0, < 6.6.9; >= 6.5.0, < 6.5.7

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

More information:

The vulnerability was publicly disclosed 12. 5. 2026.

FortiOS - RCE (CVE-2025-53844)
CVSS 8.8 (High)

An authenticated remote attacker is able to gain elevated privileges and execute code on a FortiGate device in FortiOS due to an out-of-bounds write in the process handling communication over the CAPWAP protocol [3].

The vulnerability is present in product:

  • FortiOS; >=7.6.0, <7.6.4; >=7.4.0, <7.4.9; >=7.2.0, <7.2.12

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

More information:

The vulnerability was publicly disclosed 12. 5. 2026.

By CESNET, z.s.p.o. Henrieta Paločková on 13. 5. 2026.

CESNET, z.s.p.o. Logo