Category: Fortinet PSIRT Advisories

CVSSv3 Score: 7.7 Multiple Improper Limitations of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerabilities [CWE-22] in FortiVoice may allow a privileged authenticated attacker to write arbitrary files...

CVSSv3 Score: 5.9 A key management error vulnerability [CWE-320] in FortiManager, FortiAnalyzer and FortiPortal may allow an authenticated admin to retrieve a certificate’s private key via the device’s admin shell....

CVSSv3 Score: 2.6 An improper access control vulnerability [CWE-284] in FortiAuthenticator Web UI may allow an authenticated attacker with at least read-only admin permission to obtain the credentials of other...

CVSSv3 Score: 5.3 An Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability [CWE-79] in FortiSandbox may allow an attacker to perform an XSS attack via crafted HTTP...

CVSSv3 Score: 7.1 A reliance on cookie without validation or integrity checking vulnerability [CWE-565] in FortiWeb may allow an unauthenticated attacker to execute arbitrary operations on the system via crafted HTTP or HTTPS...

CVSSv3 Score: 6.2 An Improper access control vulnerability [CWE-284] in FortiSOAR may allow Information disclosure to an authenticated attacker via crafted requests Revised on 2025-12-09 00:00:00

CVSSv3 Score: 7.0 An Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) vulnerability [CWE-78] in FortiSandbox may allow an authenticated attacker to execute unauthorized code...

CVSSv3 Score: 6.9 An improper neutralization of special elements used in an OS command (‘OS Command Injection’) vulnerability [CWE-78] in FortiSandbox GUI may allow an authenticated privileged attacker to execute...

CVSSv3 Score: 4.4 A use of password hash instead of password for authentication vulnerability [CWE-836] in FortiWeb may allow an unauthenticated attacker to use the hash in place of the password to authenticate via crafted...

CVSSv3 Score: 6.5 An Unverified Password Change vulnerability [CWE-620] in FortiSOAR may allow an attacker who gained access to a victim’s user account to reset the account credentials without being prompted for the...

CVSSv3 Score: 6.4 An Incorrect Authorization vulnerability [CWE-863] in FortiPortal may allow an authenticated attacker to reboot a shared FortiGate device via crafted HTTP requests. Revised on 2025-12-09...

CVSSv3 Score: 5.3 An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSLVPN may allow an attacker to maintain access to network resources via an active session not terminated after a user’s password...