PT-2025-10770

Name of the Vulnerable Software and Affected Versions: FortiAnalyzer versions 7.4.0 through 7.4.2 FortiAnalyzer versions prior to 7.2.5 FortiManager versions 7.4.0 through 7.4.2 FortiManager versions prior to 7.2.5 FortiAnalyzer-BigData versions 7.4.0 FortiAnalyzer-BigData versions prior to 7.2.7...

CVE-2024-55590: Improper Neutralization of Special Elements used in an OS Command

Multiple improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerabilities CWE-78 in Fortinet FortiIsolator version 2.4.0 through 2.4.5 allows an authenticated attacker with at least read-only admin permission and CLI access to execute unauthorized code via...

CVE-2024-45328: Incorrect Authorization

An incorrect authorization vulnerability CWE-863 in FortiSandbox 4.4.0 through 4.4.6 may allow a low priviledged administrator to execute elevated CLI commands via the GUI console menu...

OS command injection in CLI command

Multiple improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerabilities CWE-78 in FortiManager CLI may allow a privileged attacker to execute unauthorized code or commands via crafted CLI requests...

Authenticated SQLI on CLI

Two improper neutralization of special elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 in FortiAnalyzer, FortiManager & FortiAnalyzer-BigData may allow a privileged attacker to execute unauthorized code or commands via specifically crafted CLI requests...

Incorrect authorization in GUI console

An incorrect authorization vulnerability CWE-863 in FortiSandbox may allow a low priviledged administrator to execute elevated CLI commands via the GUI console menu...

PT-2025-10782 · Fortinet · Fortiisolator

Name of the Vulnerable Software and Affected Versions: Fortinet FortiIsolator versions 2.4.0 through 2.4.5 Description: The issue is related to multiple improper neutralization of special elements used in an OS command, also known as 'OS Command Injection'. This allows an authenticated attacker...

CVE-2025-24049: Improper Neutralization of Special Elements used in a Command

Improper neutralization of special elements used in a command 'command injection' in Azure Command Line Integration CLI allows an unauthorized attacker to elevate privileges locally...

Use of hardcoded key used for remote backup server password encryption

A Use of Hard-coded Cryptographic Key vulnerability CWE-321 in FortiSandbox may allow a privileged attacker with super-admin profile and CLI access to read sensitive data via CLI...

PT-2025-10769

Name of the Vulnerable Software and Affected Versions: Fortinet FortiManager, FortiAnalyzer versions 7.4.0 through 7.4.2 Fortinet FortiManager, FortiAnalyzer versions 7.2.0 through 7.2.5 Fortinet FortiManager, FortiAnalyzer versions 7.0.0 through 7.0.12 Fortinet FortiManager, FortiAnalyzer versio...

PT-2025-10773

Name of the Vulnerable Software and Affected Versions: FortiMail versions 7.6.0 through 7.6.1 FortiMail versions prior to 7.4.3 Description: A stack-buffer overflow issue in FortiMail CLI allows a privileged attacker to execute arbitrary code or commands via specifically crafted CLI commands...

Fortinet FortiSandbox security vulnerability

Fortinet FortiSandbox is an APT Advanced Persistent Threat protection appliance from Fortinet. The appliance offers dual sandboxing technology, dynamic threat intelligence system, real-time control panel and reporting. A security vulnerability exists in Fortinet FortiSandbox versions 4.4.0 to...

Stack buffer overflow in CLI command

A stack-buffer overflow vulnerability CWE-121 in FortiMail CLI may allow a privileged attacker to execute arbitrary code or commands via specifically crafted CLI commands...

Multiple command injections on CLI

Multiple improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerabilities CWE-78 in FortiIsolator may allow an authenticated attacker with at least read-only admin permission and CLI access to execute unauthorized code via specifically crafted CLI commands...

PT-2025-10772

Name of the Vulnerable Software and Affected Versions: FortiSandbox versions 4.4.0 through 4.4.6 Description: An incorrect authorization issue may allow a low-privileged administrator to execute elevated CLI commands via the GUI console menu. This could potentially lead to privilege escalation...

CVE-2024-33501: Improper Neutralization of Special Elements used in an SQL Command

Two improper neutralization of special elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 in Fortinet FortiAnalyzer version 7.4.0 through 7.4.2 and before 7.2.5, FortiManager version 7.4.0 through 7.4.2 and before 7.2.5 and FortiAnalyzer-BigData version 7.4.0 and before 7.2.7...

PT-2025-11053

Name of the Vulnerable Software and Affected Versions FortiSandbox versions 4.4.6 and below FortiSandbox versions 4.2.7 and below FortiSandbox versions 4.0.5 and below FortiSandbox versions 3.2.4 and below FortiSandbox versions 3.1.5 and below FortiSandbox versions 3.0.5 through 3.0.7 Description...

CVE-2024-32123: Improper Neutralization of Special Elements used in an OS Command

Multiple improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiManager, FortiAnalyzer versions 7.4.0 through 7.4.2 7.2.0 through 7.2.5 and 7.0.0 through 7.0.12 and 6.4.0 through 6.4.14 and 6.2.0 through 6.2.12 and 6.0.0 through 6.0.12 and 5.6.0...

CVE-2024-46663: Stack-based Buffer Overflow

A stack-buffer overflow vulnerability CWE-121 in Fortinet FortiMail CLI version 7.6.0 through 7.6.1 and before 7.4.3 allows a privileged attacker to execute arbitrary code or commands via specifically crafted CLI commands...

Brute-force Attack

org.wildfly.core, wildfly-elytron-integration is vulnerable to Brute-force Attack. The vulnerability is due to the lack of rate limiting on failed authentication attempts via CLI, allows attackers to perform multiple failed authentication attempts within a short time frame due to the lack of rate...