Multiple Fortinet Flaws Enable Code Execution and Access

Affected Environment
FortiOS, FortiProxy, FortiPAM, FortiSandbox, FortiAnalyzer, FortiManager and related Cloud/PaaS platforms. Applies to organisations using Fortinet for firewalling, analysis, management and sandboxing.

Threat Overview
Vulnerabilities enable code execution, auth bypass, path traversal, SQL injection, XSS and file modification or deletion. Attackers may gain persistent access, alter configs or access sensitive data on affected Fortinet systems.

Exposure Timeline
Fortinet advisories and this Smarttech247 report were issued in April 2026. Exploitation is already known for CVE-2025-61624; other CVEs may be targeted after disclosure.

Attack Surface
Exposed Fortinet management, sandbox, firewall and proxy interfaces increase risk, especially if internet-facing. Privileged local or admin access on Fortinet appliances and cloud consoles also represents an attack path.

Technical Root Cause
Issues include path traversal, missing authentication, credential exposure, heap overflow, XSS, OS command and SQL injection flaws. Weak input validation, insufficient access control and insecure credential handling underlie most vulnerabilities.

Exploitation Pathway
Attackers can send crafted HTTP or CLI requests, or exploit CAPWAP and JRPC APIs to run code or bypass controls. Some flaws require local subnet or privileged accounts; others are remotely exploitable and unauthenticated.