This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Fortinet fixes 11 vulnerabilities in various products

Fortinet fixes 11 vulnerabilities in various products. The most severe vulnerabilities are listed below. Individual products and their fixed versions: FortiOS - 7.6.7 [1][2][3][4][5][6] FortiPAM - 1.8.3 [1][2][3] FortiProxy - 7.4.14, 7.6.6 [1][2][3][4][5][6] FortiSIEMWindowsAgent - 7.4.2 [7] FortiSandbox (FSA-500G, FSA-1500G) - 4.4.9, 5.0.3 [8] FortiSIEM - 7.2.7, 7.3.5, 7.4.1 [9] FortiClientEMS - 7.4.6 [10] FortiAuthenticator - 6.5.8, 6.6.3 [11]

FortiAuthenticator - sensitive information leak (CVE-2025-53379)
CVSS 7.5 (High)

Allows an unauthenticated remote attacker to gain access to sensitive information in FortiAuthenticator by sending specially crafted requests [11].

The vulnerability is present in product:

  • FortiAuthenticator; >=6.6.0, <6.6.3; >=6.5, <6.5.7;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C

More information:

The vulnerability was publicly disclosed 14. 7. 2026.

FortiClientEMS - entity impersonation (CVE-2026-59836)
CVSS 7.5 (High)

Allows an unauthenticated remote attacker with a valid API key to impersonate an AD Connector in FortiClientEMS [10].

The vulnerability is present in product:

  • FortiClientEMS; >=7.2.0, <7.4.1; >=7.4.3, <7.4.6;

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

More information:

The vulnerability was publicly disclosed 14. 7. 2026.

FortiSIEM - XSS (CVE-2026-59838)
CVSS 5.9 (Medium)

Allows an authenticated remote attacker with administrator privileges to carry out an XSS attack in FortiSIEM [9].

The vulnerability is present in product:

  • FortiSIEM; >=6.4.0, <7.2.7; >=7.3.0, <7.3.5; >=7.4.0, <7.4.1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C

More information:

  • CVE-2026-59838 at cve.org, NVD
  • CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) at cwe.mitre.org

The vulnerability was publicly disclosed 14. 7. 2026.

FortiSandbox - unauthorized access (CVE-2026-59835)
CVSS 8.6 (High)

Allows an unauthenticated remote attacker to gain access to the VNC of virtual machines that are currently performing analysis in FortiSandbox [8].

The vulnerability is present in product:

  • FortiSandbox; >=4.4.3, <4.4.9; >=5.0.0, <5.0.3;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C

More information:

The vulnerability was publicly disclosed 14. 7. 2026.

FortiSIEMWindowsAgent - RCE (CVE-2026-59841)
CVSS 7.5 (High)

Allows an unauthenticated adjacent attacker to execute arbitrary code in FortiSIEMWindowsAgent by impersonating a monitoring machine (supervisor). The vulnerability is exploitable only if the Windows device has the "Supers Override" functionality enabled [7].

The vulnerability is present in product:

  • FortiSIEMWindowsAgent; >=4.2.0, <7.4.2

CVSS: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

More information:

  • CVE-2026-59841 at cve.org, NVD
  • CWE-923: Improper Restriction of Communication Channel to Intended Endpoints at cwe.mitre.org

The vulnerability was publicly disclosed 14. 7. 2026.

FortiOS, FortiPAM, FortiProxy - (CVE-2026-23573)
CVSS 6.1 (Medium)

Allows an authenticated remote attacker to carry out a reflected XSS attack in FortiOS, FortiPAM and FortiProxy. The vulnerability is exploitable only if the "Agentless SSL-VPN" functionality is enabled [1].

The vulnerability is present in products:

  • FortiOS; >=7.2.0, <7.6.7;
  • FortiPAM; >=1.0.0, <1.8.1;
  • FortiProxy; >=7.2.0, <7.2.10; >=7.4.0, <7.4.4;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C

More information:

  • CVE-2026-23573 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 14. 7. 2026.

By CESNET, z.s.p.o. Martin Krajči on 15. 7. 2026.

CESNET, z.s.p.o. Logo