FortiGuard PSIRT advisories for FortiOS, FortiGate, FortiClient, FortiManager, and other Fortinet products.
64 changes, newest first
EmergencyVulnerability
Linux kernel RCE CVE-2026-98432 (FG-IR-26-188)
FG-IR-26-188 · CVE-2026-98432 · CVSS 9.8 — CVE-2026-98432:ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. Another cpu can concurrently process a retransmitted SYN for the same request socket, and send a SYNACK from tcp_check_req(). tcp_v4_send_synack() and inet_csk_route_req() read…
PHP2Shell core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619) (FG-IR-26-186)
FG-IR-26-186 · CVE-2026-109618, CVE-2026-109619 +1 · CVSS 5.3 — CVE-2026-109618PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this…
Arbitrary file write in grpc phQueryMaster (FG-IR-26-180)
FG-IR-26-180 · CVSS 9.4 — An Improper limitation of a pathname to a restricted directory ('path traversal') [CWE-22] in FortiSIEM may allow an unauthenticated attacker to execute unauthorized code or commands via specially crafted packets.
FG-IR-26-183 · CVSS 3.4 — A missing authorization vulnerability [CWE-862] in FortiSIEM GUI may allow an authenticated attacker to execute unauthorized code or commands via Specially crafted HTTP requests
FG-IR-26-182 · CVSS 2.1 — A Double Free vulnerability [CWE-415] in FortiOS, FortiProxy and FortiSwitch may allow a local authenticated attacker to crash the newcli daemon via crafted CLI commands.
FG-IR-26-179 · CVSS 4.9 — A Use of Hard-coded Cryptographic Key [CWE-321] in FortiSandbox and FortiSandbox Cloud API may allow an unauthenticated attacker to access some endpoints via specially crafted HTTP requests
FG-IR-26-181 · CVSS 6.7 — An Improper Locking vulnerability [CWE-667] in FortiOS may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP requests.
Improper access control and session management in the web management interface (FG-IR-26-185)
FG-IR-26-185 · CVSS 9.6 — An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiSandbox GUI may allow a remote unauthenticated attacker to bypass authentication via crafted HTTP requests.
Multiple Arbitrary File Read/Write via SQL Injection (FG-IR-26-178)
FG-IR-26-178 · CVSS 7.9 — An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiAnalyzer, FortiManager, FortiManager Cloud and FortiAnalyzer Cloud may allow a low privileged user to execute arbitrary commands via crafted requests.
