Fortinet security advisory (AV26-1037) - Update 1

Serial Number: AV26-1037Date: October 13, 2026Updated: October 23, 2026 As of October 13, 2026, Fortinet is affected by vulnerabilities in the following products: FortiAnalyzer Prior to 7.6.5 Prior to 7.4.8 Prior to 7.6.5 FortiAnalyzer Cloud Prior to 7.6.5 Prior to 7.4.8 Prior to 7.2.12 FortiManager Prior to 7.6.5 Prior to 7.4.7 FortiManager Cloud Prior to 7.6.5 FortiMail Prior to 7.6.4 Prior to 7.4.6 Prior to 7.2.9 FortiSIEM Prior to 7.5.1 FortiSandbox Prior to 4.4.10 Prior to 5.0.7 FortiSandbox PaaS 4.4 all versions Versions prior to 5.0.7 Update 1 Open-source reporting indicates that CVE-2026-106173 is being exploited in the wild. The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Multiple Arbitrary File Read/Write via SQL Injection Arbitrary file write in grpc phQueryMaster SQL command injection in webmail Improper access control and session management in the web management interface Fortinet PSIRT Advisories