Fortinet dropped 89 advisories on Tuesday covering nearly 100 vulnerabilities, SecurityWeek reports. The release comes three weeks after Fortinet said it had added frontier AI models to its product security testing.
- About 17 are critical. FortiMail got the most critical fixes, followed by FortiAuthenticator, FortiOS, FortiManager and FortiAnalyzer, and FortiSASE and FortiClient got critical fixes too.
- The critical bugs include code execution, authentication bypass, access across VDOMs, account takeover, IBE webmail session compromise and command execution as super admin.
- Baldur Security’s Kevin Joensen found a FortiClient bug he calls Fortinet2Shell. When FortiPAM is enabled, a CORS misconfiguration lets a malicious web page talk to a local service and reliably run code.
- There are nearly 80 high-severity fixes on top of that. Fortinet hasn’t reported any of them being exploited.
My take
This is what AI-assisted bug hunting looks like from the customer’s side: a much bigger patch day. If you’ve got FortiGates or FortiMail exposed to the internet, start with those. It usually doesn’t take attackers long to reverse-engineer Fortinet patches.
God Bless, and Use the Source!
