Node2Shell CVEs
2026-10-29T08:52:17Z•2caab1119352259dd524587c42cd02ca6f6f0c30979f6b6af77ed56c9de7ec0c
CVE-2022-0778CVE-2026-105481CVE-2026-105482CVE-2026-105483CVE-2026-106069CVE-2026-106070CVE-2026-106071CVE-2026-106072CVE-2026-106073CVE-2026-106074CVE-2026-109618CVE-2026-109619CVE-2026-111497FortiAnalyzerFortiMailFortiManagerFortiMonitorOnSightFortiOSFortiPAMFortiProxyFortiSIEMFortiSOARFortiSandboxFortinetNode.jsOpenSSLPHPPSIRTSQL-injectionaccess-controlarbitrary-file-writeauthentication-bypasscertificate-validationcommand-injectioncross-site-scriptingdenial-of-servicepath-traversalremote-code-execution
What happened
Fortinet PSIRT advisories covering multiple vulnerabilities in Fortinet products and related Node.js/PHP components. Issues include unauthenticated remote code execution, authentication bypass, arbitrary file write, path traversal, SQL and command injection, sensitive information exposure, denial of service, XSS, access-control flaws, and cryptographic or certificate-validation weaknesses. The highest-risk items include an exploited-in-the-wild arbitrary file write flaw (CVSS 9.8), FortiSandbox NAT-rule access exposing sensitive information (CVSS 9.9), authentication bypasses (CVSS up to 9.8),
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- fortinet_blog
- Record identifier
- 2caab1119352259dd524587c42cd02ca6f6f0c30979f6b6af77ed56c9de7ec0c
- Enrichment time
- 2026-10-29T08:52:17Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.