Fortinet Security Updates – 11 February 2026

The addressed vulnerabilities could allow the attacker to bypass authentication mechanisms, conduct SQL injection and cross-site scripting attacks, perform request smuggling attacks, execute unauthorized code or commands, gain elevated privileges, obtain sensitive information, bypass firewall and access control policies, or gain unauthorized administrative access to the affected products.

Sample of the addressed vulnerabilities:

1. FortiClientEMS SQLi in the Administrative Interface Vulnerability (CVE-2026- 21643):

• CVSS: 9.1
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Consequences: Gain Access

2. FortiOS LDAP Authentication Bypass Vulnerability in Agentless VPN and FSSO (CVE-2026-22153):

• CVSS: 7.5
• Attack Vector: Network
• Attack Complexity: High
• Privileges Required: None
• User Interaction: None
• Consequences: Bypass Security

Sample of the affected products:

• FortiAnalyzer.
• FortiManager.
• FortiProxy.
• FortiWeb.
• FortiClientEMS.
• FortiOS.