Improper limitation of a pathname to a restricted directory
2026-10-07T20:52:16Z•fa25d96a3b3e9ca8493ffed7625d0eb44db071b5109f7d7b5bd20b4100153ddf
CVE-2022-0778CVE-2026-49975FortiAnalyzerFortiClientFortiManagerFortiOSFortiPAMFortiProxyFortiSASEFortiSIEMFortiSOARFortiSandboxFortiWebFortinetJWTPSIRTRCESSRFaccess controlarbitrary file writeauthentication bypassbuffer overflowcertificate validationcommand injectiondenial of serviceexploitation in the wildpath traversal
What happened
Fortinet PSIRT advisories covering multiple vulnerabilities across FortiOS, FortiProxy, FortiClient, FortiManager, FortiSandbox, FortiSIEM, FortiSOAR, FortiWeb, FortiPAM, FortiMonitorOnSight, FortiAnalyzer, FortiSASE, and related components. Issues include unauthenticated path traversal with arbitrary file write reportedly exploited in the wild, authentication and access-control bypasses, static-key JWT forgery, command injection, memory corruption, certificate-validation flaws, information disclosure, denial of service, SSRF, XSS, WAF evasion, and HTTP/2 denial of service. The highest-priorit
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- fortinet_blog
- Record identifier
- fa25d96a3b3e9ca8493ffed7625d0eb44db071b5109f7d7b5bd20b4100153ddf
- Enrichment time
- 2026-10-07T20:52:16Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.