Fortinet Patches Nearly 100 Vulnerabilities
Fortinet on Tuesday released 89 security advisories addressing nearly 100 vulnerabilities across its products, including 17 critical-severity flaws.
The massive release comes three weeks after Fortinet announced it has integrated frontier AI models into its product security testing, enabling more efficient discovery of security defects. This approach gives customers time to prioritize upgrades before technical details become public, which matters even more as AI shortens the time between disclosure and exploitation.
Approximately 17 of the newly resolved flaws are critical-severity issues, several of which could be exploited for arbitrary code execution. Other critical bugs could lead to authentication bypass, account takeover, access to other VDOMs, and secure email compromise.
Critical Product Fixes
FortiMail received the largest batch of critical fixes, followed by FortiAuthenticator, FortiOS, FortiManager, and FortiAnalyzer. New FortiSASE and FortiClient updates also resolve critical issues.
The root cause is a CORS misconfiguration that allows attacker-controlled web pages to communicate with a local service and reliably execute arbitrary code.
High-Severity Vulnerabilities
Fortinet also patched nearly 80 high-severity vulnerabilities that could lead to XSS attacks, code execution, denial-of-service conditions, and privilege escalation. The company makes no mention of any of these security defects being exploited in the wild.
Related
