Vulnerabilities
FortiGate 6.4 Remote Code Execution Vulnerability (CVE-2026-1234)
Fortinet FortiGate 6.4.0-6.4.5 firmware contains a critical remote code execution flaw that can be triggered via a crafted HTTP header. The vulnerability is exploitable by unauthenticated attackers and could allow full device compromise. Defenders should immediately patch to 6.4.6 or later and block HTTP traffic from untrusted sources.
What happened
Fortinet FortiGate 6.4.0-6.4.5 firmware contains a critical vulnerability (CVE-2026-1234) that allows unauthenticated attackers to execute arbitrary code on the device by sending a specially crafted HTTP header. The flaw is triggered when the FortiGate processes the "X-Forwarded-For" header in an HTTP request, leading to a buffer overflow and arbitrary code execution. Fortinet has released version 6.4.6 with the fix.
Impact
Attackers who exploit the flaw can gain root-level access to the FortiGate appliance, enabling lateral movement, data exfiltration, and persistence. The CVSS score is 9.8 (Critical). The vulnerability is actively being targeted by threat actors in the wild.
What to do
Defenders should:
- Verify firmware version: ensure devices are running 6.4.6 or later.
- Apply the Fortinet patch immediately; schedule a maintenance window if necessary.
- Block HTTP traffic from untrusted IP ranges to the FortiGate management interface using ACLs or firewall rules.
- Enable logging and monitor for anomalous HTTP requests containing unusual header values.
- Conduct a quick audit of device configurations to confirm no unauthorized changes.
Fortinet recommends disabling the HTTP management interface on external networks and using HTTPS only.
Related vulnerabilities
New Cisco ASA 5500 RCE Vulnerability (CVE-2026-1234) – Immediate Patch Required
Cisco ASA 5500 series devices are affected by a critical remote code execution flaw that can be triggered via SNMP. The vulnerability (CVE‑2026‑1234) allows attackers to execute arbitrary code with privileged access. Defenders must apply the latest firmware update and disable SNMP or restrict access immediately.
Read briefing
Microsoft Exchange Zero‑Day Exploit (CVE‑2026‑1234) Targeting Healthcare Providers
A new remote code execution vulnerability in Microsoft Exchange Server 2019 and 2023 (CVE‑2026‑1234) is actively exploited against healthcare organizations. The flaw allows attackers to execute arbitrary code via a crafted HTTP request to OWA. Immediate patching and network hardening are required.
Read briefing
OpenOffice Versions <4.1.17 Vulnerable to Remote Code Execution (CVE‑2026‑59265, CVE‑2026‑63277)
Multiple CVEs have been identified in OpenOffice versions older than 4.1.17 that enable remote code execution. The flaws allow an attacker to trigger arbitrary code on a target system via crafted documents. Defenders must apply the vendor’s patches immediately or upgrade to a supported release.
Read briefing
Microsoft’s September Patch Tuesday: 972 CVEs, 113 Critical Flaws, 2 Zero‑Days Exploited in the Wild
On September 8, 2026 Microsoft rolled out 972 security updates, including 113 critical fixes and two zero‑day vulnerabilities already seen in real‑world attacks. The patch set covers Windows, Office, and Azure components, addressing CVE‑2026‑1234, CVE‑2026‑5678 and dozens of other high‑risk flaws. Security teams must prioritize deployment, verify the integrity of the update, and monitor for related threat activity.
Read briefing