Arbitrary file write in grpc phQueryMaster
2026-10-17T08:52:15Z•39480d14c797261320dceb9b80380c309676e71bc329edab1c578db5134d823a
CVE-2022-0778CVE-2026-49975CWE-22CWE-287FortiAnalyzerFortiClientFortiMailFortiManagerFortiOSFortiPAMFortiProxyFortiSIEMFortiSOARFortiSandboxFortiWebFortinetJWTPSIRTSQL injectionXSSarbitrary file writeauthentication bypassauthorization bypasscommand injectiondenial of servicehard-coded cryptographic keypath traversal
What happened
Fortinet PSIRT feed containing numerous vulnerabilities across FortiOS, FortiProxy, FortiSIEM, FortiSandbox, FortiManager, FortiAnalyzer, FortiMail, FortiWeb, FortiSOAR, FortiClient, FortiPAM and related products. Issues include unauthenticated authentication bypasses, arbitrary file write/path traversal, command and SQL injection, authorization flaws, static cryptographic keys, denial of service, certificate-validation weaknesses, and XSS. Several vulnerabilities have critical CVSS scores, including a path traversal/NULL-byte arbitrary file write reportedly exploited in the wild, FortiSandbox
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- fortinet_blog
- Record identifier
- 39480d14c797261320dceb9b80380c309676e71bc329edab1c578db5134d823a
- Enrichment time
- 2026-10-17T08:52:15Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.