Arbitrary process termination from exposed minifilter communication port
2026-09-20T08:52:15Z•4bf30230b2a91d1863ea5e9a800b1ab89a221e6fe89934e9980bec7d2008b09e
CVE-2022-0778CVE-2026-49975FortiClientFortiManagerFortiOSFortiProxyFortiSandboxFortiWebFortinetPSIRTSSRFWAF-evasionXSSaccess-controlauthentication-bypassbuffer-overflowcertificate-validationcommand-injectiondenial-of-serviceinformation-disclosuremultiple-vulnerabilitiesremote-code-execution
What happened
Fortinet PSIRT advisories disclose multiple vulnerabilities across FortiClient, FortiSOAR, FortiSandbox, FortiPAM, FortiMonitorOnSight, FortiOS, FortiProxy, FortiSIEM, FortiAnalyzer, FortiManager, FortiWeb, FortiSASE, FortiAuthenticator, and related products. Issues include authentication and access-control bypasses, arbitrary code execution, command injection, sensitive-information disclosure, denial of service, SSRF, XSS, certificate-validation flaws, buffer overflows, and WAF evasion. The most severe items are a static JWT signing key enabling unauthenticated authentication bypass (CVSS 9.6
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- fortinet_blog
- Record identifier
- 4bf30230b2a91d1863ea5e9a800b1ab89a221e6fe89934e9980bec7d2008b09e
- Enrichment time
- 2026-09-20T08:52:15Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.