[UPDATE] Fortinet Products: Multiple Vulnerabilities
A BSI Warn- und Informationsdienst (WID): Schwachstellen-Informationen (Security Advisories) ·
Admiralty grading (A–F · 1–6)
Source reliability
- A Completely reliable
- B Usually reliable
- C Fairly reliable
- D Not usually reliable
- E Unreliable
- F Cannot be judged
Information credibility
- 1 Confirmed
- 2 Probably true
- 3 Possibly true
- 4 Doubtful
- 5 Improbable
- 6 Cannot be judged
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
Key insight
Multiple vulnerabilities in the Fortinet product family allow an anonymous attacker to execute code and bypass security controls; Fortinet appliances are among the preferred targets of state-sponsored actors, which raises prioritisation beyond routine patch management.
Description
The German BSI warning and information service reports multiple vulnerabilities in the Fortinet products FortiManager, FortiOS, FortiMail, FortiClient and FortiAnalyzer. A remote, anonymous attacker can exploit these to execute arbitrary code, escalate privileges, bypass security controls, cause a denial of service, and disclose and manipulate data. The report is an update and aggregates several vulnerabilities without listing individual CVE IDs. It contains no CVSS scores, no information on exploitation in the wild, and no indication of inclusion in KEV catalogues.
Risk score
- cvss base
- 0.00
- kev bonus
- 0.00
- epss bonus
- 0.00
- poc bonus
- 0.00
- raw before weight
- 0.00
- industry weight
- 1.21
- freshness factor
- 1.00
- exploitability factor
- 1.00
- days old
- 0.00
- vendor mismatch penalty
- 0.00
Path: operational