Fortinet Product Security Update Advisory
overview
We have released security updates that address vulnerabilities in Fortinet products. users of affected products are encouraged to update to the latest version.
affected Products
CVE-2025-54820
FortiManager Versions: 7.4.0 and later and 7.4.2 and earlier
FortiManager Versions: 7.2.0 and earlier and 7.2.10 and earlier
FortiManager version: 6.4 full version
CVE-2026-22627
FortiSwitchAXFixed Version: 1.0.0 or later and 1.0.1 or earlier
CVE-2026-24017
FortiWeb Version: 8.0.0 or later and 8.0.2 or earlier
FortiWeb version: 7.6.0 or later and 7.6.5 or earlier
FortiWeb version: 7.4.0 or later and 7.4.10 or earlier
FortiWeb version: 7.2.0 or later and 7.2.11 or earlier
FortiWeb version: 7.0.0 or later and 7.0.11 or earlier
CVE-2026-24018
FortiClientLinux versions: 7.4.0 and later and 7.4.4 and earlier
FortiClientLinux version: 7.2.2 or later and 7.2.12 or earlier
CVE-2026-35616
FortiClientEMS Versions: 7.4.5 and later and 7.4.6 and earlier
resolved Vulnerabilities
Stack-based buffer overflow vulnerability in the FortiManager fgtupdates service (CVE-2025-54820)
Buffer overflow vulnerability in FortiSwitchAXFixed (CVE-2026-22627)
Authentication Attempt Limit Bypass Vulnerability in FortiWeb (CVE-2026-24017)
Privilege escalation vulnerability in FortiClientLinux (CVE-2026-24018)
API authentication and authorization bypass vulnerability in FortiClient EMS (CVE-2026-35616)
vulnerability patches
Vulnerability patches have been made available in the latest updates. please follow the instructions on the reference site to update to the latest version of the vulnerability patch.
CVE-2025-54820
FortiManager version: 7.4.3
FortiManager version: 7.2.11
FortiManager Version: Migrating to a Revised Release
CVE-2026-22627
FortiSwitchAXFixed Version: 1.0.2 and later
CVE-2026-24017
FortiWeb Version: 8.0.3 and later
FortiWeb Version: 7.6.6 and later
FortiWeb version: 7.4.11 and later
FortiWeb version: 7.2.12 and later
FortiWeb version: 7.0.12 and later
CVE-2026-24018
FortiClientLinux Version: 7.4.5
FortiClientLinux Version: 7.2.13
CVE-2026-35616
FortiClient EMS Version: 7.4.5 with Hotfix[6]
FortiClient EMS Version: 7.4.6 with Hotfix[7]
FortiClient EMS version: 7.4.7 and later
references
[1] Buffer overflow via fgtupdates service
https://fortiguard.fortinet.com/psirt/FG-IR-26-098
[2] Buffer Overflow in LLDP OUI field
https://fortiguard.fortinet.com/psirt/FG-IR-26-086
[3] Authentication rate-limit bypass permits to brute force admin logins
https://fortiguard.fortinet.com/psirt/FG-IR-26-082
[4] Local privilege escalation via improper symlink following
https://fortiguard.fortinet.com/psirt/FG-IR-26-083
[5] API authentication and authorization bypass
https://fortiguard.fortinet.com/psirt/FG-IR-26-099
[6] Installing an EMS hotfix
https://docs.fortinet.com/document/forticlient/7.4.5/ems-release-notes/832484
[7] Installing an EMS hotfix
https://docs.fortinet.com/document/forticlient/7.4.6/ems-release-notes/832484