Fortinet PSIRT Advisory · June 2026
FortinetScheduled
3
Total
Deduplicated CVEs in this cycle. For Microsoft, only CVEs first published on Patch Tuesday itself count, excluding browser updates, late additions and cloud fixes.
1
Critical
CVEs with CVSS 9.0 or higher (critical per NVD scale).
0
Zero-day
Actively exploited at time of disclosure (CISA KEV or vendor-confirmed).
0
KEV
Listed in CISA's Known Exploited Vulnerabilities catalog: mandatory for US agencies, best practice for everyone.
By product family
Unassigned3 CVEs
| Critical | CVE-2026-25089 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests Listed in CISA KEV | — | 9.1 |
| Medium | CVE-2025-67862 | An Internal Asset Exposed to Unsafe Debug Access Level or State vulnerability [CWE-1244] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.2, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2.0 through 7.2.10, FortiOS 7.0.0 through 7.0.16, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0 all versions may allow an authenticated admin to execute lua scripts via crafted CLI commands. | — | 6.0 |
| Medium | CVE-2026-49938 | A improper access control vulnerability in Fortinet FortiPortal 7.4.0 through 7.4.7, FortiPortal 7.2.0 through 7.2.8, FortiPortal 7.0 all versions may allow attacker to improper access control via <insert attack vector here> | — | 6.2 |