Fortinet Patches 22 Flaws, Administrators Must Update Immediately!

Information:

   Fortinet is a global cybersecurity leader famous for its Fortinet Security Fabric, an integrated ecosystem that automates protection across networks and devices using custom-built ASIC chips for superior speed. Leading products include FortiGate (Next-Gen Firewalls), FortiClient (Endpoint Security), FortiAP (Secure Wireless), and FortiAnalyzer (Centralized Logging & Analytics), all working together to provide seamless, real-time defense.

Incident:

  Fortinet has released security updates addressing 22 vulnerabilities, including high-severity flaws affecting FortiWeb, FortiSwitchAX, FortiManager, and FortiClientLinux. If exploited, these high-severity issues could enable remote, unauthenticated attackers to circumvent authentication rate limits or execute unauthorized code and commands.

  The update also resolves several medium- and low-severity vulnerabilities. These flaws pose risks ranging from data tampering and security bypasses to denial-of-service (DoS), privilege escalation, and information disclosure. At this time, Fortinet reports no evidence that any of these vulnerabilities are being actively exploited in the wild.

Incident:

  CVE-2026-22627 (Critical - CVSS 8.8)

  This vulnerability in Fortinet FortiSwitchAXFixed1 can be exploited by an attacker who has access to the same local network segment as the affected system. Because it does not require authentication and has low attack complexity, exploitation may straightforward.

  If successfully exploited, this vulnerability may allow authenticated attacker within the same adjacent network to execute unauthorized code or commands on the device via sending a crafted LLDP packet.

Incident:

  CVE-2025-54820 (Critical – CVSS 8.1)

  This vulnerability in Fortinet FortiManager 7 is remotely exploitable over the network and does not require authentication.

  Although the attack complexity is high, meaning specific conditions must be met, successful exploitation can have severe consequences.

  An attacker who successfully exploits this vulnerability may allow a remote unauthenticated attacker to execute unauthorized commands via crafted requests, if the service is enabled. The success of the attack depends on the ability to bypass the stack protection mechanisms.

Incident:

  CVE-2026-24017 (Critical – CVSS 8.1)

  This vulnerability in Fortinet FortiWeb 8 shares similar characteristics to CVE-2025-54820 and is also remotely exploitable without authentication.

  If exploited, this vulnerability may allow a remote unauthenticated attacker to bypass the authentication rate-limit via crafted requests. The success of the attack depends on the attacker's resources and the password target complexity.

Incident:

  CVE-2026-24018 (High – CVSS 7.8)

  This is a vulnerability in Fortinet FortiClientLinux 7 local privilege escalation vulnerability that requires an attacker to already have low-level access to the system.

  Because exploitation is considered low complexity, an attacker who gains initial access through another vector may quickly escalate privileges.

  Successful exploitation may allow a local and unprivileged user to escalate their privileges to root.

 The important things is Security systems. We must concern and monitor as usual.
For more information please contact
Email :sales@inetms.co.th
065 149 2822 (Ms.Suphatson )
063 204 4534 (Ms.Atsamaphorn)
065 929 6330 (Ms.Kansinee)
061 387 9439 (Ms.Sirilak)
092 257 6902 (Ms.Narusorn)
063 197 7510 (Mr.Yanotai)
065 725 7405 (Ms.Nattharini)
065 725 7405 (Ms.Donraya)

Recommendation:

• Update to the patched versions listed below:

  Version	Affected	Solution
  FortiSwitchAXFixed 1.0	1.0.0 through 1.0.1	Upgrade to 1.0.2 or above
  FortiManager 7.6	Not affected	Not Applicable
  FortiManager 7.4	7.4.0 through 7.4.2	Upgrade to 7.4.3 or above
  FortiManager 7.2	7.2.0 through 7.2.10	Upgrade to 7.2.11 or above
  FortiManager 6.4	6.4 all versions	Migrate to a fixed release
  FortiWeb 8.0	8.0.0 through 8.0.2	Upgrade to 8.0.3 or above
  FortiWeb 7.6	7.6.0 through 7.6.5	Upgrade to 7.6.6 or above
  FortiWeb 7.4	7.4.0 through 7.4.10	Upgrade to 7.4.11 or above
  FortiWeb 7.2	7.2.0 through 7.2.11	Upgrade to 7.2.12 or above
  FortiWeb 7.0	7.0.0 through 7.0.11	Upgrade to 7.0.12 or above
  FortiClientLinux 8.0	Not affected	Not Applicable
  FortiClientLinux 7.4	7.4.0 through 7.4.4	Upgrade to 7.4.5 or above
  FortiClientLinux 7.2	7.2.2 through 7.2.12	Upgrade to 7.2.13 or above

Reference :

• https://fortiguard.fortinet.com/psirt/FG-IR-26-083
• https://www.fortiguard.com/psirt/FG-IR-26-082
• https://www.fortiguard.com/psirt/FG-IR-26-098
• https://fortiguard.fortinet.com/psirt/FG-IR-26-086

Weekly Interesting CVE

Malware News or Campaign IOC/IOA | EN

Ref: https://www.scworld.com/brief/fake-7-zip-website-distributes-trojanized-installer-turns-pcs-into-proxy-nodes