—–BEGIN PGP SIGNED MESSAGE—–

Hash: SHA256

Multiple vulnerabilities in Fortinet Products

Indian – Computer Emergency Response Team (https://www.cert-in.org.in)

Severity Rating: HIGH

Software Affected

FortiClientWindows versions 7.4.0 through 7.4.3

FortiClientWindows versions 7.2.0 through 7.2.11

FortiWeb versions 8.0.0 through 8.0.2

FortiWeb versions 7.6.0 through 7.6.6

FortiWeb versions 7.4.0 through 7.4.11

FortiWeb versions 7.2.0 through 7.2.12

FortiManager version 7.6.1

FortiManager versions 7.4.3 through 7.4.5

FortiManager versions 7.2.5 through 7.2.9

FortiManager Cloud version 7.6.1

FortiManager Cloud versions 7.4.3 through 7.4.5

FortiManager Cloud versions 7.2.5 through 7.2.9

Overview

Multiple vulnerabilities have been reported in Fortinet products which could allow an attacker to execute arbitrary code and gain unauthorized access to the targeted system.

Target Audience:

Individuals and organizations using the affected Fortinet products.

Risk Assessment:

High risk of unauthorized access and arbitrary code execution.

Impact Assessment:

Potential for complete system compromise.

Description

Fortinet FortiClientWindows, FortiWeb, FortiManager, and FortiManager Cloud are security products used for endpoint protection, web application security, and centralized management of Fortinet devices.

These vulnerabilities exist in the affected Fortinet products due to improper authentication and memory corruption issues. An attacker may exploit these vulnerabilities using specially crafted requests.

Successful exploitation could allow an attacker to execute arbitrary code and gain unauthorized access to the targeted system.

Solution

Apply appropriate updates/workarounds as mentioned in:

https://fortiguard.fortinet.com/psirt/FG-IR-26-156

https://fortiguard.fortinet.com/psirt/FG-IR-26-158

https://fortiguard.fortinet.com/psirt/FG-IR-26-160

Vendor Information

Fortinet

https://fortiguard.fortinet.com/psirt

References

 

https://fortiguard.fortinet.com/psirt/FG-IR-26-156

https://fortiguard.fortinet.com/psirt/FG-IR-26-158

https://fortiguard.fortinet.com/psirt/FG-IR-26-160

CVE Name

CVE-2026-70465

CVE-2026-26035

CVE-2026-70468

– —

Thanks and Regards,

CERT-In

Incident Response Help Desk

e-mail: incident@cert-in.org.in

Phone: +91-11-22902657

Toll Free Number: 1800-11-4949

Toll Free Fax : 1800-11-6969

Web: http://www.cert-in.org.in

PGP Fingerprint: A768 083E 4475 5725 B81A A379 2156 C0C0 B620 D0B4

PGP Key information:

https://www.cert-in.org.in/s2cMainServlet?pageid=CONTACTUS

Postal address:

Indian Computer Emergency Response Team (CERT-In)

Ministry of Electronics and Information Technology

Government of India

Electronics Niketan

6, C.G.O. Complex

New Delhi-110 003

—–BEGIN PGP SIGNATURE—–

iQIzBAEBCAAdFiEE6r4Iam/Ey0c/KakL3jCgcSdcys8FAmqVi8sACgkQ3jCgcSdc

ys/ZOw//SBU1jetpjJrn1PxhgajEdYTNvtOx+W9a/ZGrDCjpwbc0wHyCns0m3rHt

TkIB8EG7yFZ2OpjdVp4DIkwnzu4Gzy+5SELop+PryRus4rHt9tO1cT1vQ5ydj58l

9++QM8rkkUMbEP/vWATbrbO/Uo5TM/+dDuTaYmxSr45CN2wbl4ktaQ+PtwO5ryYd

i+W7bQs4lXhYAXjO42MWijm1fGTlLgepYlk+I2O51O2WUCtacHiIToJJCPOyNm6H

aQ2yjFGKTevGiYMwxfI4o2pAUGJ7f5Kqm54cc1JBH0Bvh6u4L0PtxNYjy9buxSLz

bUsu4mu185I7Oa9w7DEdIIjwa1eSRyphJHjPVHWdYu4yDhXsoqvKGRqtO0obPZ+X

l17Csw0bUp4ppUifh93eb+WwYvJvEdHmqeMn/uLOzcTF+zcc3gr3o4Xz2GYTVAb1

I6VmMQh5x/v0nycsOqqWoeclIAB0PMhISzfrriXHmVZg4yUgbki7H1LtosuaeCrS

yR0m0ZzDtJLjFsLcoJfNlNldfzjdOOXIBT7ITYMVGzc5NDcO0++M99uDgfoYNMIF

X4UtIu5x3B0FZ2CquQkKaiu3IMNBV+RAFaHK7I90D3i8nOZZjlI6Z7ytkozSOIdi

kScbxTAmFblsJsec/BUNHdf2QdbFz2T/P4csSe36qtSN9miuI8Q=

=SYSO

—–END PGP SIGNATURE—–