Arbitrary process termination from exposed minifilter communication port
2026-09-13T08:52:16Z•b99828d2e93b274b8c2062af24f1c5e9446a9ab04eca664eba32ea8dd6b08d47
CVE-2022-0778CVE-2026-49975CWE-284CWE-287FortiClientFortiManagerFortiMonitorOnSightFortiOSFortiPAMFortiProxyFortiSIEMFortiSandboxFortiWebFortinetPSIRTSSRFWAF-evasionXSSarbitrary-code-executionauthentication-bypassbuffer-overflowcertificate-validationcommand-injectiondenial-of-serviceimproper-access-controlinformation-disclosurevulnerability-advisory
What happened
Fortinet PSIRT feed containing numerous vulnerabilities across FortiOS, FortiProxy, FortiClient, FortiSandbox, FortiManager, FortiWeb, FortiSIEM, FortiPAM, FortiMonitorOnSight and related products. Issues range from low-severity open redirects and denial of service to critical unauthenticated authentication bypasses, sensitive-information exposure, command injection, arbitrary code execution, and man-in-the-middle attacks. The highest-risk entries include a static JWT signing key enabling unauthenticated FortiMonitorOnSight web portal authentication bypass (CVSS 9.6), FortiPAM browser-traffic
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- fortinet_blog
- Record identifier
- b99828d2e93b274b8c2062af24f1c5e9446a9ab04eca664eba32ea8dd6b08d47
- Enrichment time
- 2026-09-13T08:52:16Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.