CVE-2023-26205 is a high-severity privilege escalation vulnerability in Fortinet FortiADC versions 6.1.x through 7.1.2. It allows an authenticated low-privileged attacker to escalate to super_admin by exploiting improper access control in the fabric automation CLI script configuration. The vulnerability requires no user interaction and can be exploited remotely over the network. The impact includes full administrative control over the FortiADC device, potentially compromising confidentiality and integrity of network traffic and configurations. No known exploits are currently reported in the wild. European organizations using FortiADC for application delivery and load balancing are at risk, especially those with exposed management interfaces.
CVE-2023-36553 is a critical OS command injection vulnerability in multiple versions of Fortinet FortiSIEM, allowing unauthenticated attackers to execute arbitrary code or commands via crafted API requests. The flaw arises from improper neutralization of special elements in OS commands, affecting versions from 4.7.2 through 5.4.0. Exploitation requires no authentication or user interaction and can lead to full system compromise, impacting confidentiality, integrity, and availability. No known exploits are currently reported in the wild, but the high CVSS score (9.3) indicates a severe risk. European organizations using FortiSIEM for security information and event management are at risk, especially in countries with high Fortinet market penetration and critical infrastructure reliance.
CVE-2023-41840 is a high-severity vulnerability affecting Fortinet FortiClientWindows versions 7.0.9 and 7.2.0. It arises from an untrusted search path issue that enables a DLL hijacking attack via a malicious OpenSSL engine library placed in the search path. Exploiting this vulnerability allows an attacker with limited privileges to escalate their privileges without requiring user interaction. The vulnerability impacts confidentiality, integrity, and availability of affected systems. No known exploits are currently reported in the wild. European organizations using FortiClientWindows, especially in countries with high Fortinet market penetration and critical infrastructure reliance on Fortinet products, are at risk.
CVE-2023-41843 is a high-severity cross-site scripting (XSS) vulnerability in multiple versions of Fortinet FortiSandbox, allowing attackers to execute unauthorized code or commands via crafted HTTP requests. The flaw arises from improper input neutralization during web page generation, affecting versions 2.4.1 through 4.4.1. Exploitation requires user interaction but no authentication, with potential impacts on confidentiality, integrity, and availability. Although no known exploits are currently in the wild, the vulnerability poses significant risk to organizations using FortiSandbox for advanced threat detection. European organizations relying on Fortinet products, especially in critical infrastructure and finance sectors, should prioritize patching and implement strict input validation and network segmentation. Countries with high Fortinet market penetration and strategic importance, such as Germany, France, the UK, and the Netherlands, are most likely to be affected.
CVE-2023-41680 is a high-severity cross-site scripting (XSS) vulnerability affecting multiple versions of Fortinet FortiSandbox. It allows an unauthenticated attacker to execute unauthorized code or commands by sending crafted HTTP requests. The vulnerability impacts confidentiality, integrity, and availability of the affected systems. Exploitation requires user interaction but no prior authentication. Although no known exploits are currently reported in the wild, the vulnerability poses significant risks to organizations relying on FortiSandbox for threat detection and sandboxing. European organizations using FortiSandbox should prioritize patching and implement strict input validation and network segmentation to mitigate risks. Countries with high Fortinet market penetration and critical infrastructure reliance on FortiSandbox are most at risk. The CVSS score of 7.3 reflects the high impact and moderate complexity of exploitation.
CVE-2023-33303 is a high-severity vulnerability in Fortinet FortiEDR versions 5.0.0 through 5.0.1 caused by insufficient session expiration. This flaw allows an unauthenticated attacker to execute unauthorized code or commands via crafted API requests. The vulnerability has a CVSS score of 7.7, indicating significant impact on confidentiality, integrity, and availability. Exploitation does not require user interaction or privileges but has a high attack complexity. No known exploits are currently reported in the wild.
CVE-2023-41679 is a high-severity vulnerability in Fortinet FortiManager versions 6.0 through 7.2.2 that allows a remote, authenticated attacker with device management permissions in one ADOM to add or delete CLI scripts in other ADOMs. This improper access control flaw enables unauthorized code execution or command injection across administrative domains, potentially compromising confidentiality, integrity, and availability of managed devices. Exploitation requires authentication with limited privileges but no user interaction, and the vulnerability has a CVSS score of 7.7. No known exploits are currently reported in the wild. European organizations using FortiManager for centralized network management are at risk, especially those with complex ADOM configurations. Mitigation involves applying vendor patches when available, restricting device management permissions, and monitoring ADOM activities closely.
CVE-2023-25607 is a high-severity OS command injection vulnerability affecting multiple versions of Fortinet FortiAnalyzer, FortiManager, and FortiADC products. The flaw arises from improper neutralization of special elements in the management interface, allowing an authenticated attacker with at least read permissions on system settings to execute arbitrary shell commands. Exploitation requires low attack complexity and no user interaction, potentially compromising confidentiality, integrity, and availability of affected systems. No known exploits are currently reported in the wild. European organizations using vulnerable Fortinet products are at risk, especially those in critical infrastructure and government sectors. Mitigation involves applying vendor patches once available, restricting access to management interfaces, and monitoring for suspicious command execution. Countries with high Fortinet market penetration and strategic cyber targets, such as Germany, France, UK, and the Netherlands, are most likely affected. The vulnerability’s CVSS score is 7.4, reflecting its high impact and moderate exploit complexity. Defenders should prioritize patching and access control to prevent unauthorized command execution.
CVE-2023-34992 is a critical OS command injection vulnerability in Fortinet FortiSIEM versions 6.4.0 through 7.0.0. It allows unauthenticated remote attackers to execute arbitrary code or commands by sending specially crafted API requests. The vulnerability arises from improper neutralization of special elements in OS commands, enabling full compromise of affected systems. Exploitation requires no authentication or user interaction and can impact confidentiality, integrity, and availability. Although no known exploits are currently reported in the wild, the high CVSS score (9.6) indicates a severe risk.
CVE-2023-36556 is a high-severity escalation of privilege vulnerability in Fortinet FortiMail webmail versions 6.0.0 through 7.2.2. It allows an authenticated attacker to access other users' accounts within the same web domain by exploiting incorrect authorization via crafted HTTP/HTTPS requests. The vulnerability does not require user interaction but does require the attacker to have valid credentials. Exploitation can lead to full compromise of confidentiality, integrity, and availability of email communications. No public exploits are currently known. European organizations using affected FortiMail versions are at risk, especially those with large deployments of Fortinet products.
CVE-2023-41841 is a high-severity privilege escalation vulnerability affecting Fortinet FortiOS versions 7.0.0 through 7.0.11 and 7.2.0 through 7.2.4. The flaw allows an attacker with prof-admin profile privileges to perform unauthorized elevated actions due to improper authorization checks.
CVE-2023-42788 is a high-severity OS command injection vulnerability affecting multiple versions of Fortinet FortiAnalyzer and FortiManager. It allows a local attacker with low privileges to execute unauthorized commands by exploiting improper neutralization of special elements in CLI commands. The flaw exists in versions 6.2.0 through 7.4.0, impacting confidentiality, integrity, and availability of affected systems. No user interaction is required, but local access with low privileges is necessary. Although no known exploits are currently reported in the wild, the vulnerability’s potential impact is significant due to the critical role of FortiAnalyzer in network security monitoring and logging. European organizations using these Fortinet products are at risk, especially those in countries with high Fortinet market penetration and critical infrastructure reliance on these devices.
CVE-2023-29183 is a high-severity cross-site scripting (XSS) vulnerability affecting Fortinet FortiProxy and FortiOS GUI versions 6.2.0 through 7.2.4. It allows an authenticated attacker with low privileges to execute arbitrary JavaScript code via crafted guest management settings, potentially compromising confidentiality, integrity, and availability. Exploitation requires user interaction but no administrative privileges. No known exploits are currently in the wild. European organizations using affected Fortinet products, especially in critical infrastructure and large enterprises, face significant risk. Mitigations include promptly applying vendor patches once available, restricting access to management interfaces, and implementing strict input validation and Content Security Policies.
CVE-2023-34984 is a high-severity vulnerability in Fortinet FortiWeb versions 6.3.6 through 7.2.1 that allows remote attackers to execute unauthorized code or commands via specially crafted HTTP requests. The flaw stems from a protection mechanism failure, enabling attackers to compromise confidentiality, integrity, and availability of affected systems. Exploitation requires no privileges but does require user interaction, and the attack complexity is high. No known exploits are currently in the wild, but the vulnerability poses significant risks to organizations relying on FortiWeb for web application security. European organizations using these FortiWeb versions should prioritize patching and implement strict network controls to mitigate potential exploitation. Countries with high Fortinet market penetration and critical infrastructure reliance on FortiWeb are at greater risk.
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.
CVE-2022-41328 is a path traversal vulnerability in Fortinet FortiOS that allows a local privileged attacker to read and write arbitrary files using crafted CLI commands. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided in the available data.
A vulnerability has been found in jamesmartin Inline SVG up to 1.7.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file lib/inline_svg/action_view/helpers.rb of the component URL Parameter Handler. The manipulation of the argument filename leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.7.2 is able to address this issue. The identifier of the patch is f5363b351508486021f99e083c92068cf2943621. It is recommended to upgrade the affected component. The identifier VDB-217597 was assigned to this vulnerability.
Fortinet FortiOS SSL-VPN contains a heap-based buffer overflow vulnerability that allows unauthenticated remote attackers to execute arbitrary code or commands. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns. No specific affected versions or patch information is provided in the available data.
CVE-2022-40684 is an authentication bypass vulnerability affecting multiple Fortinet products including FortiOS, FortiProxy, and FortiSwitchManager. This flaw allows unauthenticated attackers to perform administrative operations via specially crafted HTTP or HTTPS requests. The vulnerability has been exploited in the wild and is known to be used in ransomware campaigns. No specific affected versions or patch information is provided in the available data.
CVE-2018-13374 is an improper access control vulnerability in Fortinet FortiOS and FortiADC. It allows attackers to retrieve LDAP server login credentials configured in FortiGate by directing an LDAP server connectivity test to a malicious LDAP server. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns.
