Fortinet Security Updates – 10 June 2026

By /
  • 179/2026
  • Critical

Fortinet has released security updates to address multiple vulnerabilities affecting several Fortinet products.

The addressed vulnerabilities could allow the attacker to obtain sensitive information, execute commands, or code via specially crafted HTTP requests to the affected product.

Sample of the addressed vulnerabilities:

1. Second-Order OS Command Injection Vulnerability (CVE-2026-25089):

  • CVSS: 9.1
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Consequences: Command Injection

2. Improper Access Control in API Endpoints Vulnerability (CVE-2026-49938):

  • CVSS: 6.2
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Consequences: Obtain Information

The affected products:

  • FortiSandbox.
  • FortiSandbox Cloud.
  • FortiSandbox PaaS.
  • FortiOS.
  • FortiProxy.
  • FortiPortal.
Vulnerabilities
  • CVE-2026-25089
  • CVE-2025-67862
  • CVE-2026-49938
Mitigations

The enterprise should deploy this patch as soon as the testing phase is completed.

Fortinet Security Advisory

References

Fortinet Security Advisory