H-ISAC TlP WHITE: Multiple Vulnerabilities in Fortinet Products Could Allow for Arbitrary Code Execution - CVE-2026-126170, and more

Multiple vulnerabilities have been discovered across Fortinet products, including FortiOS, FortiManager, FortiAnalyzer, and FortiSandbox. 

Currently, there are no reports of these vulnerabilities being exploited actively in the wild.

It is highly recommended that administrators apply official vendor updates promptly after proper testing, adhere to the principle of least privilege, and implement robust network segmentation and vulnerability management processes.

Health-ISAC provides this information to increase situational awareness and encourage organizations to assess their risk exposure to these vulnerabilities.

Additional Info

Overview:

Multiple vulnerabilities impact several Fortinet platforms, including FortiOS, FortiManager, FortiAnalyzer, and FortiSandbox.

The identified flaws cover various initial access techniques, including SQL injection, path traversal, authentication bypass, and command injection in public-facing applications. Unintended exploitation could enable unauthorized code execution, system modifications, or account creation depending on account access levels.

Currently, there are no reported instances of active exploitation in the wild.

Successful exploitation of the most severe of these vulnerabilities could result in arbitrary code execution. Depending on the privileges associated with the account, an attacker could then install programs, view, change, or delete data, or create new accounts with full user rights. Accounts configured with fewer user rights on the system could be less impacted than those operating with administrative user rights.

Vulnerabilities:

• Fortinet FortiManager and FortiAnalyzer 
  • Improper Encoding or Escaping of Output (JSON Injection) (CVE-2026-126170)
  • SQL Injection (CVE-2026-126262, CVE-2026-126175, CVE-2026-126213)
  • Authorization Bypass Through User-Controlled Key (CVE-2026-126229, CVE-2026-126183, CVE-2026-126218)
  • Improper Authorization (CVE-2026-126261) - Health-ISAC published a separate advisory for this.
  • Server-Side Request Forgery (SSRF) (CVE-2026-126260)
  • OS Command Injection (CVE-2026-126179, CVE-2026-126226, CVE-2026-126231, CVE-2026-126236)
  • Argument Injection (CVE-2026-126224)
  • Code Injection (CVE-2026-126182, CVE-2026-126185)
  • Template Injection (Improper Neutralization of Special Elements Used in a Template Engine) (CVE-2026-126180, CVE-2026-126234)
  • Use of Externally-Controlled Format String (CVE-2026-126171, CVE-2026-126230)
  • Path Traversal (CVE-2025-61625, CVE-2026-126219, CVE-2026-126222, CVE-2026-126235)
  • Heap-based Buffer Overflow (CVE-2026-126178, CVE-2026-126212)
  • Stack-based Buffer Overflow (CVE-2026-126223)
  • Out-of-bounds Write (CVE-2026-126228)
  • Authentication Bypass by Spoofing (CVE-2026-126184)
  • Improper Certificate Validation (CVE-2026-126232)
  • Incorrect Authorization (CVE-2026-126214)
  • Missing Authorization (CVE-2026-126225)
  • Improper Privilege Management (CVE-2026-126211)
  • Unintended Proxy or Intermediary (Confused Deputy) (CVE-2026-126227)
  • Unrestricted Upload of File with Dangerous Type (CVE-2026-126233)
  • Use of Hard-coded Credentials (CVE-2026-126181)
  • XML Injection (CVE-2026-126176)
• Fortinet FortiOS and FortiSASE 
  • Authentication Bypass by Primary Weakness in the OSPF daemon (CVE-2026-126253)
  • Numeric Truncation Error in the BGP daemon (CVE-2026-126254)
  • Missing Authentication for Critical Function in HA (CVE-2026-126259)
  • Path Traversal in the SSH daemon (CVE-2026-126255)
  • Out-of-bounds Read/Write in the kernel (CVE-2026-126256)
  • Stack-based Buffer Overflow in the WAD proxy (CVE-2026-126258)
  • Improper Certificate Validation in SSL-VPN (CVE-2026-121528)
  • Improper Authentication in Remote RADIUS administrator two-factor authentication (CVE-2026-121530)
• Fortinet FortiSandbox 
  • Cross-site Scripting (XSS) in the start vnc endpoint (CVE-2026-26248)

View the detailed report below.