Vulnerabilities
FortiOS/Proxy/PAM Trusted Host Bypass via SSH CLI
An authenticated admin can bypass the trusted host policy on FortiOS, FortiProxy, and FortiPAM using a crafted SSH command. The flaw is a low‑severity privilege‑management issue (CWE-269). Defenders should patch and harden SSH access.
What happened
An authenticated administrator can bypass the trusted host policy on FortiOS, FortiProxy, and FortiPAM by sending a specially crafted SSH CLI command. The flaw is an improper privilege management issue (CWE-269) that allows the policy to be ignored.
Impact
- Administrators may connect from untrusted hosts without being blocked.
- Potential for lateral movement if an attacker gains admin credentials.
- Low CVSS score (1.8) but still relevant for security posture.
What to do
- Apply the latest FortiOS, FortiProxy, and FortiPAM updates that patch the CLI command handling.
- Verify that the trusted host policy is still enforced by attempting a test SSH connection from an untrusted IP.
- Restrict SSH access to the management interface to known IP ranges and enable two-factor authentication for admin accounts.
- Audit admin command logs for anomalous CLI usage.
Mitigation
Fortinet recommends updating firmware to the latest version and disabling the vulnerable CLI command if a patch is not immediately available.
Related vulnerabilities
CISA Malcolm Authentication Bypass via Case-Insensitive Nginx Proxy – CVE-2026-107336
CISA Malcolm versions ≤26.07.1 are vulnerable to authentication bypass through a case‑insensitive Nginx reverse‑proxy rule that forwards unauthenticated requests to the Arkime backend. The flaw allows attackers to forge X‑Forwarded‑User headers and access Arkime data without credentials. Defenders should upgrade to v26.08.0 or apply the vendor patch immediately.
Read briefing
Visual Studio Code Path Traversal Vulnerability (CVE-2026-102229) – Information Disclosure
A path traversal flaw in Visual Studio Code allows an authenticated user to read arbitrary files on the host via network requests. All versions are affected; apply the latest update or restrict network exposure.
Read briefing
FortiSandbox GUI Authentication Bypass Exploit (CVSS 9.6) – Immediate Mitigation Required
FortiSandbox web interface allows unauthenticated attackers to bypass login via crafted HTTP requests. CVSS 9.6 indicates critical risk. Defenders must patch, restrict GUI access, enable MFA, and monitor for anomalous traffic.
Read briefing
Microsoft Office for Mac CVE‑2026‑88210 Security Feature Bypass Fixed
A security feature bypass in Microsoft Office for Mac (CVE‑2026‑88210) could allow code execution via malicious documents. The issue is fixed in the latest update; only Office for Mac users need to act. Other Office products are unaffected.
Read briefing