Multiple critical vulnerabilities across Fortinet's product suite, including FortiOS, FortiAnalyzer, FortiManager, FortiAP, FortiAuthenticator, FortiClientWindows, and FortiMail, allow remote attackers to achieve denial of service, privilege escalation, remote code execution, information disclosure, and security restriction bypass. Affected versions include FortiOS 7.2.0 through 7.2.11, 7.4.0 through 7.4.8, and 7.6.0 through 7.6.3, with similar specific version ranges listed for all other impacted products. Fortinet has released fixes; administrators must immediately apply the patches referenced in the provided FortiGuard PSIRT advisories (FG-IR-26-123 through FG-IR-26-137).
Multiple vulnerabilities were identified in Fortinet Products. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, elevation of privilege, remote code execution, sensitive information disclosure and security restriction bypass on the targeted system. Impact Remote Code Execution Denial of Service Security Restriction Bypass Information Disclosure Elevation of Privilege System / Technologies affected FortiAnalyzer 7.2 all versions FortiAnalyzer 7.4.0 through 7.4.8 FortiAnalyzer 7.6.0 through 7.6.4 FortiAP 6.4 all versions FortiAP 7.2 all versions FortiAP 7.4.0 through 7.4.5 FortiAP 7.6.0 through 7.6.2 FortiAP-U 7.0.0 through 7.0.5 FortiAP-W2 7.2 all versions FortiAP-W2 7.4.0 through 7.4.4 FortiAuthenticator 6.5.0 through 6.5.6 FortiAuthenticator 6.6.0 through 6.6.8 FortiAuthenticator 8.0.2 FortiAuthenticator 8.0.0 FortiClientWindows 7.2 all versions FortiClientWindows 7.4.0 through 7.4.2 FortiMail 7.2.0 through 7.2.8 FortiMail 7.4.0 through 7.4.5 FortiMail 7.6.0 through 7.6.3 FortiManager 7.2 all versions FortiManager 7.4.0 through 7.4.8 FortiManager 7.6.0 through 7.6.4 FortiOS 7.2.0 through 7.2.11 FortiOS 7.4.0 through 7.4.8 FortiOS 7.6.0 through 7.6.3 Solutions Before installation of the software, please visit the vendor web-site for more details. Apply fixes issued by the vendor: https://fortiguard.fortinet.com/psirt/FG-IR-26-123 https://fortiguard.fortinet.com/psirt/FG-IR-26-128 https://fortiguard.fortinet.com/psirt/FG-IR-26-129 https://fortiguard.fortinet.com/psirt/FG-IR-26-131 https://fortiguard.fortinet.com/psirt/FG-IR-26-132 https://fortiguard.fortinet.com/psirt/FG-IR-26-133 https://fortiguard.fortinet.com/psirt/FG-IR-26-137