Arbitrary file write in grpc phQueryMaster
2026-10-16T20:52:16Z•a09fe5f3e2791815141d0de9285313aced76f457c7a42f665fbb5531e42f96b2
CVE-2022-0778CVE-2026-49975CWE-22CWE-78CWE-89FortiAnalyzerFortiClientFortiMailFortiManagerFortiOSFortiPAMFortiProxyFortiSIEMFortiSOARFortiSandboxFortiWebFortinetJWTPSIRTSQL-injectionXSSaccess-controlarbitrary-file-writeauthentication-bypasscommand-injectiondenial-of-servicepath-traversal
What happened
Fortinet PSIRT feed containing numerous vulnerabilities across FortiOS, FortiProxy, FortiSIEM, FortiSandbox, FortiManager, FortiAnalyzer, FortiMail, FortiWeb, FortiSOAR, FortiClient, FortiPAM and related products. Issues include unauthenticated authentication bypasses, arbitrary file write, command injection, SQL injection, path traversal, static-key JWT forgery, access-control flaws, denial of service, XSS, and certificate-validation weaknesses. Several vulnerabilities have critical severity ratings, including one path-traversal issue reported as exploited in the wild, requiring urgent patch6
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- fortinet_blog
- Record identifier
- a09fe5f3e2791815141d0de9285313aced76f457c7a42f665fbb5531e42f96b2
- Enrichment time
- 2026-10-16T20:52:16Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.