Multiple Vulnerabilities in Fortinet Products

Affected Environment

FortiOS, FortiAP, FortiAP-W2, FortiAP-U, FortiSandbox, FortiSandbox Cloud/PaaS, FortiAnalyzer, and FortiManager deployments.

Threat Overview

Five CVEs enabling RCE, privilege escalation, auth bypass, OS command injection, and denial-of-service conditions.

Exposure Timeline

Vulnerabilities disclosed 12–13 May 2026; no confirmed active exploitation reported at time of publication.

Attack Surface

Network-accessible management interfaces, CLI, capwap daemon, and web UI across multiple Fortinet product lines.

Technical Root Cause

Out-of-bounds write, OS command injection, missing authorisation, dangerous function use, and improper input neutralisation flaws.

Exploitation Pathway

Authenticated or unauthenticated attackers send crafted HTTP/CLI requests to trigger vulnerable code paths and gain control.