This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Fortinet warns of actively exploited vulnerabilities and compromise of firewalls and VPNs

Fortinet warns of 3 vulnerabilities in various products [1][2][3], described below. According to the threat intelligence company Defused, attackers are actively attempting to exploit the critical vulnerability (CVE-2026-25089) [1] in FortiSandbox [4]. In addition, security experts warn of the compromise of tens of thousands of Fortinet firewalls and VPN gateways as part of the FortiBleed campaign [5][6]. More information about the campaign, including a link to the database of affected domains and the recommended course of action, can be found below. Latest fixed versions of individual products: FortiOS [2] - 8.0.0, 7.6.7, 7.4.12, 7.2.11 [7] FortiPortal [3] - 7.4.11, 7.2.9 [8] FortiProxy [2] - 7.6.6, 7.4.11, 7.2.16 [9] FortiSandbox [1] - 5.2.0, 5.0.6, 4.4.9 [10] The Defused notice [4] also reports exploitation attempts against two previously reported [11] vulnerabilities in FortiSandbox [12][13]. Apart from the above vulnerabilities, we would like to draw attention to the recently uncovered massive compromise of credentials for more than 75,000 Fortinet firewalls and VPN gateways in 194 countries, which occurred as part of the FortiBleed attack campaign [5]. According to available information, the attackers combined large-scale attacks with mass cracking of login hashes. Detailed technical information about the campaign can be found at [5][6]. You can check whether your domain is on the list of affected domains at [14]. Subsequently, an immediate change of all passwords related to Fortinet VPN and the administration interface, as well as the activation of MFA, is strongly recommended, as successful exploitation potentially gives attackers full remote access to the organization's entire network.

FortiSandbox - OS command execution (CVE-2026-25089)
CVSS 9.8 (Critical)

An unauthenticated remote attacker can execute arbitrary commands at the operating system level of the device by sending specially crafted HTTP requests with JSON data to the VNC start function (start vnc) in the web administration interface of FortiSandbox products (including the Cloud and PaaS versions) [1].

The vulnerability is present in products:

  • FortiSandbox; >=4.4.0, <4.4.9; >=5.0.0, <5.0.6
  • FortiSandbox Cloud; >=5.0.4, <5.0.6;
  • FortiSandbox PaaS; >=5.0.4, <5.0.6;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

  • CVE-2026-25089 at cve.org, NVD
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 9. 6. 2026.

FortiOS, FortiProxy - Lua script execution (CVE-2025-67862)
CVSS 6.7 (Medium)

An authenticated local attacker with an administrator role can execute Lua scripts in the command-line interface of FortiOS and FortiProxy by means of specially crafted commands [2].

The vulnerability is present in products:

  • FortiOS; >=7.2.0, <7.2.11; >=7.4.0, <7.4.8; >=7.6.0, <7.6.3;
  • FortiProxy; >=7.2.0, <7.2.15; >=7.4.0, <7.4.11; >=7.6.0, <7.6.4;

CVSS: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 9. 6. 2026.

FortiPortal - data disclosure (CVE-2026-49938)
CVSS 6.5 (Medium)

A remote authenticated attacker with a regular user role can obtain sensitive network configuration data in FortiPortal by means of specially crafted HTTP requests to the API [3].

The vulnerability is present in product:

  • FortiPortal; >=7.0, <=7.0.14; >=7.2.0, <7.2.9; >=7.4.0, <7.4.8;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

More information:

The vulnerability was publicly disclosed 9. 6. 2026.

By CESNET, z.s.p.o. Michaela Ručková on 17. 6. 2026.

CESNET, z.s.p.o. Logo