FORTINET has released a set of patches addressing 13 vulnerabilities across eight product lines, issued on 13 October 2026. The most serious flaws are two unauthenticated, remote-exploitation risks: an authentication bypass in FortiSandbox (CVE-2026-107656) with a CVSS of 9.6, and an unauthenticated arbitrary file write (path traversal) in FortiSIEM (CVE-2026-106173) with a CVSS of 9.4. Fortinet notes that neither flaw requires a login, making them particularly critical for exposed appliances.
The broader vulnerability roundup totals 11 CVEs with severities ranging from critical to low; Fortinet also warns that exploitation in the wild has not been confirmed at this time.
The affected products include FortiSandbox (versions 5.0.0–5.0.6 and 4.4.0–4.4.9; FortiSandbox 5.2 is not affected) and FortiSIEM (7.5.0; 7.6 and FortiSIEM Cloud are not affected). Other fixes cover FortiAnalyzer, FortiManager, FortiMail, and FortiOS. Notable CVEs include CVE-2025-46773 (FortiAnalyzer/FortiManager SQL injection) and CVE-2025-57739 (FortiMail SQL injection), among others.
Fortinet’s patch guidance urges applying updates promptly: FortiSandbox to 5.0.7 or 4.4.10, FortiSIEM to 7.5.1, and corresponding fixed releases for FortiAnalyzer, FortiManager, FortiMail, and FortiOS (including a FortiGuard virtual patch FG-VD-61291 for the GUI DoS). Until patched, Fortinet recommends restricting access on TCP port 27918 for FortiSIEM.