Improper limitation of a pathname to a restricted directory
2026-10-02T08:52:15Z•4c00fa8144c3b891f9602ebcb6558220afd55b77b49fc2117bd9305474e8346b
CVE-2022-0778CVE-2026-49975FortiClientFortiManagerFortiOSFortiProxyFortiSIEMFortiSandboxFortiWebFortinetJWT forgeryOpenSSLPSIRTWAF evasionactively exploitedarbitrary file writeauthentication bypasscertificate validationcommand injectiondenial of serviceimproper access controlinformation disclosurepath traversalremote code execution
What happened
Fortinet PSIRT feed containing numerous product vulnerabilities disclosed or revised in 2026, including an actively exploited unauthenticated path traversal and null-byte flaw allowing arbitrary file writes. Other notable issues include authentication bypasses, improper access control, JWT forgery, command injection, remote code execution, certificate-validation weaknesses, information disclosure, denial of service, and WAF evasion across FortiOS, FortiProxy, FortiManager, FortiSandbox, FortiSIEM, FortiWeb, FortiClient, FortiMonitorOnSight, FortiSOAR, FortiPAM, and related products. The feed's
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- fortinet_blog
- Record identifier
- 4c00fa8144c3b891f9602ebcb6558220afd55b77b49fc2117bd9305474e8346b
- Enrichment time
- 2026-10-02T08:52:15Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.