Do you use Fortinet devices? Several security vulnerabilities have been patched in FortiOS, FortiProxy, FortiPAM, and FortiSandbox!

On July 14, 2026, Fortinet released official security advisories regarding seven new security vulnerabilities identified in its core security products — FortiOS, FortiProxy, FortiPAM, and FortiSandbox.

The discovered vulnerabilities include Path Traversal, Buffer Overflow, Cross-Site Scripting (XSS), CRLF Injection, as well as unauthenticated access to the VNC service. Although none of them have been rated as “Critical,” some affect security devices widely deployed in corporate networks, which is why experts strongly recommend applying updates as soon as possible.

The vulnerabilities have been identified in the following Fortinet products and versions:

These products perform critical functions such as protecting corporate networks, controlling internet traffic, managing privileged accounts, and analyzing suspicious files in an isolated environment. Therefore, any vulnerability in them can have a negative impact on overall network security.

The vulnerabilities announced by Fortinet include:

Which vulnerabilities are the most dangerous?

According to experts, two cases among the announced vulnerabilities require particular attention.

CVE-2026-59835 — Unauthenticated VNC in FortiSandbox

This vulnerability is related to the Virtual Network Computing (VNC) service on FortiSandbox devices being accessible without authentication on all network interfaces.