Fortinet Patches Nearly 100 Vulnerabilities Across Its Products

Summary

Fortinet issued 89 advisories covering nearly 100 vulnerabilities, including about 17 critical flaws. A researcher said a FortiClient flaw could enable code execution when FortiPAM is enabled; Fortinet did not mention in-the-wild exploitation.

Key points

Fortinet’s 89 advisories address nearly 100 vulnerabilities across its products.
About 17 flaws are critical; several could allow arbitrary code execution, and others could enable authentication bypass, account takeover, or command execution.
FortiMail received the largest batch of critical fixes, followed by FortiAuthenticator, FortiOS, FortiManager, and FortiAnalyzer.
Researcher Kevin Joensen said a FortiClient flaw, dubbed Fortinet2Shell, could allow arbitrary code execution when FortiPAM is enabled and a victim visits a malicious website.
Joensen attributed Fortinet2Shell to a CORS misconfiguration that lets attacker-controlled web pages communicate with a local service.
Fortinet also patched nearly 80 high-severity vulnerabilities, including flaws that could enable code injection, denial of service, privilege escalation, or information disclosure.
The article says Fortinet did not mention whether any of the flaws were being exploited in the wild.

Article Details

Event Type: Fortinet released 89 security advisories addressing nearly 100 vulnerabilities across its products.
Impact: Approximately 17 fixes address critical-severity vulnerabilities, some of which could enable arbitrary code execution; other reported impacts include authentication bypass, account takeover, privilege escalation, information disclosure, and denial of service. A FortiClient flaw may allow arbitrary code execution when FortiPAM is enabled and a victim visits a malicious website. Fortinet made no mention of exploitation in the wild.

People

Kevin JoensenBaldur Security principal security consultant who described the FortiClient vulnerability’s CORS misconfiguration and its potential for arbitrary code execution; he named the flaw Fortinet2Shell.

Vendors

FortinetFortinet on Tuesday dropped 89 new security advisories that address nearly 100 vulnerabilities across its products.

Products

FortiAnalyzerFortiMail received the largest batch of critical fixes, followed by FortiAuthenticator, FortiOS, FortiManager, and FortiAnalyzer. New FortiSASE and FortiClient updates also resolve critical issues.FortiAuthenticatorFortiMail received the largest batch of critical fixes, followed by FortiAuthenticator, FortiOS, FortiManager, and FortiAnalyzer. New FortiSASE and FortiClient updates also resolve critical issues.FortiClientFortiMail received the largest batch of critical fixes, followed by FortiAuthenticator, FortiOS, FortiManager, and FortiAnalyzer. New FortiSASE and FortiClient updates also resolve critical issues.FortiMailFortiMail received the largest batch of critical fixes, followed by FortiAuthenticator, FortiOS, FortiManager, and FortiAnalyzer. New FortiSASE and FortiClient updates also resolve critical issues.FortiManagerFortiMail received the largest batch of critical fixes, followed by FortiAuthenticator, FortiOS, FortiManager, and FortiAnalyzer. New FortiSASE and FortiClient updates also resolve critical issues.FortiOSFortiMail received the largest batch of critical fixes, followed by FortiAuthenticator, FortiOS, FortiManager, and FortiAnalyzer. New FortiSASE and FortiClient updates also resolve critical issues.FortiPAMto Baldur Security principal security consultant Kevin Joensen, the FortiClient bug is exploitable if FortiPAM is enabled and could allow an attacker to execute arbitrary code if the victim visits a malicious FortiSASEFortiMail received the largest batch of critical fixes, followed by FortiAuthenticator, FortiOS, FortiManager, and FortiAnalyzer. New FortiSASE and FortiClient updates also resolve critical issues.