Author: Cyberthreat Blog

An Incorrect Provision of Specified Functionality vulnerability [CWE-684] in FortiOS may allow a local authenticated attacker to execute system commands via crafted CLI commands. Revised on 2025-10-14 00:00:00

An Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) vulnerability [CWE-78] in FortiSOAR may allow an attacker who has already obtained a non-login low privileged shell access...

An Improper Validation of Certificate with Host Mismatch vulnerability [CWE-297] in FortiOS and FortiProxy ZTNA proxy may allow an unauthenticated attacker in a man-in-the middle position to intercept and tamper with connections...

An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiSIEM may allow an authenticated attacker to perform a stored cross site scripting (XSS) attack via crafted HTTP requests. Revised on...