Do Son Fortinet security updates for FortiOS, FortiManager and FortiAnalyzer fix critical AI-found flaws. Advisories follow November 10. Patch now.
FortiOS
CISA KEV additions on July 27 flag two known exploited vulnerabilities: Arista VeloCloud CVE-2026-16812 and FortiOS CVE-2025-68686. Patch both now.
Fortinet warns of critical flaw CVE-2026-24858 exploited in the wild. Attackers use FortiCloud SSO to bypass auth on FortiOS/Manager. Patch now.
A Critical (CVSS 9.1) flaw in Fortinet's FortiCloud SSO allows unauthenticated admin bypass by forging SAML messages (Improper Signature Verification). The feature is often auto-enabled. Update or disable immediately.
Discover the details of CVE-2024-55591, a critical vulnerability in Fortinet's FortiOS and FortiProxy. Learn how to protect your systems from this authentication bypass flaw.
UNC3886 exploited a now-patched vulnerability in FortiOS, alongside a custom malware ecosystem targeting Fortinet devices
CVE-2023-45590 - A "code injection" flaw in FortiClient Linux could allow an attacker to trick a user into visiting a malicious website
FortiOS & FortiProxy: Critical Risks (CVE-2023-42789, CVE-2023-42790) These carry the highest severity ratings (9.8 and 8.1)
CVE-2023-33308 in FortiOS and FortiProxy might allow a remote attacker to execute arbitrary code or commands via carefully crafted packets
CVE-2023-25610 allows an unauthenticated attacker to execute arbitrary code on the system, caused by a heap buffer underflow in the administrative interface