1.0 Introduction
Recently, Fortinet has released security updates to address multiple vulnerabilities in several Fortinet products.
2.0 Impact
Successful exploitation of these vulnerabilities may allow an attacker to trigger cross-site scripting, denial of service, elevation of privilege, information disclosure and data manipulation on the targeted system. Key issues include:
- A SQL injection in FortiAnalyzer, FortiManager and their Cloud variants (CVE-2025-46773, CVE-2026-23705, CVE-2026-23706 and CVE-2026-23707) may allow a low-privileged user to execute arbitrary commands via crafted requests.
- A SQL injection in the FortiMail webmail (CVE-2025-57739) may allow an authenticated attacker to execute unauthorised code or commands via crafted HTTP requests.
- An OS command injection in the FortiManager fgfmd daemon (CVE-2026-106171) may allow a remote attacker impersonating a FortiManager cluster node to execute unauthorised code or commands. This requires the node’s certificate and private key.
- An improper locking flaw in FortiOS (CVE-2026-106174) may allow an unauthenticated attacker with network access to cause a denial of service of the HTTPS management interface via crafted HTTP requests.
- A double free in FortiOS, FortiProxy and FortiSwitch (CVE-2026-106175) may allow a local authenticated attacker to crash the newcli daemon via crafted CLI commands.
- An HTML injection in the FortiManager and FortiAnalyzer WebUI (CVE-2020-12811) may allow cross-site scripting via the Identity Provider name field.
3.0 Affected Products
- FortiAnalyzer 6.2.0 through 6.2.6; 7.2 all versions; 7.4.0 through 7.4.7; 7.6.0 through 7.6.4
- FortiAnalyzer Cloud 7.2.1 through 7.2.11; 7.4.1 through 7.4.7; 7.6.2 through 7.6.4
- FortiManager 6.2.0 through 6.2.6; 7.2 all versions; 7.4.0 through 7.4.6; 7.6.0 through 7.6.6; 8.0.0
- FortiManager Cloud 7.6.2 through 7.6.6
- FortiMail 7.2.0 through 7.2.8; 7.4.0 through 7.4.5; 7.6.0 through 7.6.3
- FortiOS 7.2 all versions; 7.4 all versions; 7.6.0 through 7.6.7; 8.0.0
- FortiProxy 7.2 all versions; 7.4 all versions; 7.6.0 through 7.6.6
- FortiSwitch 7.2 all versions; 7.4 all versions; 7.6.0 through 7.6.6
4.0 Recommendation
CyberSecurity Malaysia encourages users and administrators to review the Fortinet security advisories and apply the necessary updates. Administrators should also restrict management interfaces (GUI, CLI, API) to trusted networks and use the Fortinet upgrade path tool at https://docs.fortinet.com/upgrade-tool.
Kindly refer to the following URL:
- https://fortiguard.fortinet.com/psirt/FG-IR-20-005
- https://fortiguard.fortinet.com/psirt/FG-IR-26-177
- https://fortiguard.fortinet.com/psirt/FG-IR-26-178
- https://fortiguard.fortinet.com/psirt/FG-IR-26-181
- https://fortiguard.fortinet.com/psirt/FG-IR-26-182
- https://fortiguard.fortinet.com/psirt/FG-IR-26-184
Generally, we advise users to be
updated with the latest security announcements by the vendor and follow best
practice security policies to determine which updates should be applied.
For further enquiries, please contact Cyber999
Incident Response Centre through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
Business Hours: Mon - Fri 08:30 -17:30 MYT
Web: https://www.cybersecurity.my
5.0 References
- https://fortiguard.fortinet.com/psirt/FG-IR-20-005
- https://fortiguard.fortinet.com/psirt/FG-IR-26-177
- https://fortiguard.fortinet.com/psirt/FG-IR-26-178
- https://fortiguard.fortinet.com/psirt/FG-IR-26-181
- https://fortiguard.fortinet.com/psirt/FG-IR-26-182
- https://fortiguard.fortinet.com/psirt/FG-IR-26-184