Fortinet published 89 security advisories this week covering nearly 100 vulnerabilities across its product line, roughly 17 of them rated critical.
Where the critical bugs landed
Three weeks earlier, the vendor said it had folded frontier AI models into product security testing. The volume that followed is its own comment on the effort.
FortiMail absorbed the biggest share of critical fixes. FortiAuthenticator, FortiOS, FortiManager and FortiAnalyzer came next, and fresh FortiSASE and FortiClient releases resolve critical issues of their own.
Bad outcomes run the length of the catalog, from arbitrary code execution and authentication bypass through LSA broadcast, account takeover, cross-VDOM reach and IBE webmail session compromise, then on to malicious attribute delivery, server-side request execution, webmail password resets and command execution as super admin.
The standout sits in FortiClient. Kevin Joensen, a principal security consultant at Baldur Security, traced it to a CORS misconfiguration letting an attacker-controlled page talk to a local service. With FortiPAM enabled, a victim who visits a malicious site hands over code execution. He named it Fortinet2Shell.
Close to 80 high-severity bugs were fixed as well, spanning cross-site scripting, code injection, arbitrary file upload, denial of service, man-in-the-middle and privilege escalation.
What admins should do with the queue
Nothing in the advisories indicates any of these defects has been exploited in the wild. Customers seeking detail are pointed to the PSIRT page.
Fortinet’s case for shipping so much at once is that internal discovery buys customers room to prioritize upgrades before technical detail reaches attackers, and that window shrinks as AI compresses the gap between disclosure and exploitation.
Work the critical band first. Patch FortiMail, confirm whether FortiPAM is enabled anywhere FortiClient runs, and stage the rest behind a normal change window.
