Multiple vulnerabilities in Fortinet products (October 14, 2026)

CERT-FR Advisory Subject: Multiple vulnerabilities in Fortinet products Document Management A detailed version history is provided at the end of this document. Risks - Security policy bypass - Remote denial of service - Remote arbitrary code execution - SQL injection (SQLi) - Privilege escalation Affected Systems - FortiAnalyzer Cloud versions 7.2.x after 7.2.1 and before 7.2.12 - FortiAnalyzer Cloud versions 7.4.x after 7.4.1 and before 7.4.8 - FortiAnalyzer Cloud versions 7.6.x after 7.6.2 and before 7.6.5 - FortiAnalyzer versions 7.6.x before 7.6.5 - FortiAnalyzer versions before 7.4.8 - FortiManager before 7.4.7 - FortiManager Cloud versions 7.6.x after 7.6.2 and before 7.6.7 - FortiManager versions 7.6.x before 7.6.7 - FortiManager versions 8.0.x before 8.0.1 - FortiOS versions 8.0.x before 8.0.1 - FortiOS versions before 7.6.9 - FortiProxy versions before 7.6.7 - FortiSandbox Cloud versions before 5.0.7 - FortiSandbox Cloud versions 5.2.x and before 5.2.2 - FortiSandbox PaaS versions before 5.0.7 - FortiSandbox versions 5.2.x before 5.2.2 - FortiSandbox versions before 5.0.7 - FortiSwitch versions before 7.6.7 Summary Multiple vulnerabilities have been discovered in Fortinet products. Some of these allow an attacker to cause remote arbitrary code execution, privilege escalation, and remote denial of service. Solutions Refer to the vendor's security bulletin for patches (see Documentation section). Documentation - Fortinet Security Bulletin FG-IR-26-176 dated October 13, 2026 https://www.fortiguard.com/psirt/FG-IR-26-176 - Fortinet Security Bulletin FG-IR-26-177 dated October 13, 2026 https://www.fortiguard.com/psirt/FG-IR-26-177 - Fortinet Security Bulletin FG-IR-26-178 dated October 13, 2026 https://www.fortiguard.com/psirt/FG-IR-26-178 - Fortinet Security Bulletin FG-IR-26-179 dated October 13, 2026 https://www.fortiguard.com/psirt/FG-IR-26-179 - Fortinet Security Bulletin FG-IR-26-181 dated October 13, 2026 https://www.fortiguard.com/psirt/FG-IR-26-181 - Fortinet Security Bulletin FG-IR-26-182 dated October 13, 2026 https://www.fortiguard.com/psirt/FG-IR-26-182 - Fortinet Security Bulletin FG-IR-26-185 dated October 13, 2026 https://www.fortiguard.com/psirt/FG-IR-26-185 - CVE Reference CVE-2025-46773 https://www.cve.org/CVERecord?id=CVE-2025-46773 - CVE Reference CVE-2026-106170 https://www.cve.org/CVERecord?id=CVE-2026-106170 - CVE Reference CVE-2026-106171 https://www.cve.org/CVERecord?id=CVE-2026-106171 - CVE Reference CVE-2026-106172 https://www.cve.org/CVERecord?id=CVE-2026-106172 - CVE Reference CVE-2026-106174 https://www.cve.org/CVERecord?id=CVE-2026-106174 - CVE Reference CVE-2026-106175 https://www.cve.org/CVERecord?id=CVE-2026-106175 - CVE Reference CVE-2026-107656 https://www.cve.org/CVERecord?id=CVE-2026-107656 - CVE Reference CVE-2026-23705 https://www.cve.org/CVERecord?id=CVE-2026-23705 - CVE Reference CVE-2026-23706 https://www.cve.org/CVERecord?id=CVE-2026-23706 - CVE Reference CVE-2026-23707 https://www.cve.org/CVERecord?id=CVE-2026-23707