Fortinet security advisories, March 2026

Fortinet advisories published in March 2026

1. Mar 10, 2026
   High [CVE-2026-24018] UNIX symbolic link (Symlink) following vulnerability in Fortinet FortiClientLinux 7.4.0 through 7.4.4, FortiClientLinux 7.2.2…

   High7.4

2. Mar 10, 2026
   High [CVE-2026-24017] Improper Control of Interaction Frequency vulnerability [CWE-799] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2…

   High7.3

3. Mar 10, 2026
   High [CVE-2026-22627] buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiSwitchAXFixed 1.0.0…

   High7.7

4. Mar 10, 2026
   High [CVE-2025-54820] Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiManager 7.4.0 through 7.4.2, FortiManager…

   High7.0

5. Mar 10, 2026
   Medium [CVE-2026-30897] stack-based buffer overflow vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb…

   Medium5.9

6. Mar 10, 2026
   Medium [CVE-2026-25972] improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSIEM…

   Medium4.1

7. Mar 10, 2026
   Medium [CVE-2026-25689] improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor…

   Medium6.0

8. Mar 10, 2026
   Medium [CVE-2026-24640] Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0…

   Medium5.9

9. Mar 10, 2026
   Medium [CVE-2026-22628] improper access control vulnerability in Fortinet FortiSwitchAXFixed 1.0.0 through 1.0.1 may

   Medium5.1

10. Mar 10, 2026
    Medium [CVE-2026-22572] FortiManager: authentication bypass using an alternate path or channel vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.3…

    Medium6.8

11. Mar 10, 2026
    Medium [CVE-2025-68648] FortiManager: use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0…

    Medium6.5

12. Mar 10, 2026
    Medium [CVE-2025-68482] FortiManager: improper certificate validation vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through…

    Medium6.3

13. Mar 10, 2026
    Medium [CVE-2025-66178] improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiWeb…

    Medium6.7

14. Mar 10, 2026
    Medium [CVE-2025-54659] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] vulnerability in…

    Medium5.5

15. Mar 10, 2026
    Medium [CVE-2025-53608] FortiSandbox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in…

    Medium4.6

16. Mar 10, 2026
    Medium [CVE-2025-49784] improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer…

    Medium5.6

17. Mar 10, 2026
    Medium [CVE-2025-48840] authentication bypass by spoofing vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.8…

    Medium5.0

18. Mar 10, 2026
    Medium [CVE-2025-48418] FortiManager: hidden functionality vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.3, FortiAnalyzer 7.4.0 through 7.4.7…

    Medium6.4

19. Mar 10, 2026
    Medium [CVE-2026-25836] OS command injection on vmimages update feature

    Medium6.7

20. Mar 10, 2026
    Low [CVE-2026-24641] NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0…

    Low2.5

21. Mar 10, 2026
    Low [CVE-2026-22629] FortiManager: improper restriction of excessive authentication attempts vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4…

    Low3.4

22. Mar 10, 2026
    Low [CVE-2025-55717] cleartext storage of sensitive information vulnerability [CWE-312] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.2…

    Low3.8