fortiguard

Live5

1. live9.0
   FortiManager FortiManager FGFM elevation before registration password verification

   Patch now · Disclosed · since 10 Nov 2026

   An improper authorization flaw in FortiManager's FGFM interface allows an unauthenticated attacker that can reach the FGFM port to execute code via crafted packets before password verification. The issue carries a CVSS v3 score of 9.0, marking it as critical.
2. live9.3
   FortiOS FortiOS/FortiSASE OSPF daemon authentication bypass via crafted LSA

   Patch now · Disclosed · since 10 Nov 2026

   An authentication bypass (CWE‑305) in the OSPF daemon of FortiOS and FortiSASE permits an unauthenticated attacker to broadcast LSAs using specially crafted requests. The vulnerability is assigned a CVSS v3 score of 9.3, indicating critical severity.
3. live9.8
   FortiMail FortiMail path traversal enables unauthorized code execution

   Patch now · Disclosed · since 10 Nov 2026

   An improper limitation of a pathname (CWE‑22) in FortiMail allows an unauthenticated attacker to traverse directories and execute unauthorized code via crafted requests. The issue is rated CVSS v3 9.8, marking it as a critical vulnerability.
4. live9.8
   FortiMail FortiMail command injection allows unauthenticated code execution

   Patch now · Disclosed · since 10 Nov 2026

   An improper neutralization of special elements in a command (CWE‑77) in FortiMail permits an unauthenticated attacker to execute unauthorized code via crafted HA join‑request packets. The vulnerability carries a CVSS v3 score of 9.8, indicating a critical risk.
5. live9.0
   FortiAuthenticator FortiAuthenticator hard‑coded password enables authentication bypass

   Patch now · Disclosed · since 10 Nov 2026

   A hard‑coded password (CWE‑259) in FortiAuthenticator can be used by an unauthenticated attacker to bypass credential validation. The flaw has a CVSS v3 score of 9.0 and may lead to unauthorized access.

Earlier0

Nothing closed yet.