The Nationaal Cyber Security Centrum has published an advisory (NCSC-2026-0355) addressing multiple security vulnerabilities in Fortinet products. The vulnerabilities include issues categorized under CWEs such as CWE-457 (use of uninitialized variable), CWE-476 (null pointer dereference), CWE-77 (command injection), CWE-297 (improper certificate validation), CWE-283 (authentication bypass), and CWE-601 (open redirect). The affected products span a broad range of Fortinet solutions including FortiAnalyzer, FortiOS, FortiPAM, FortiProxy, FortiSandbox, FortiManager, FortiManager Cloud, FortiMonitorOnSight, FortiClient Windows, FortiSIEM, and FortiSOAR. The advisory references ten CVEs (CVE-2026-84385 through CVE-2026-84393 and CVE-2026-26084, CVE-2026-22575). No CVSS scores or detailed version information are provided, and no known exploits have been reported. Patch availability is not explicitly stated in the provided data.

The vulnerabilities collectively could allow attackers to perform actions such as command injection, bypass authentication, cause denial of service through null pointer dereferences, exploit improper certificate validation, and redirect users to malicious sites. The broad range of affected products indicates a potentially wide impact across Fortinet's security product portfolio. However, no active exploitation has been reported, and the exact impact depends on the specific vulnerability and product context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the advisory indicates vulnerabilities have been addressed, it is recommended to consult Fortinet's official security advisories or updates for patches or fixes. Until patches are applied, organizations should follow vendor guidance and consider risk mitigation strategies specific to the affected products.