Fortinet patches 7 critical flaws including VNC exposure in FortiSandbox — update now

Fortinet this week shipped security updates addressing seven vulnerabilities across FortiOS, FortiProxy, FortiPAM, FortiSASE and FortiSandbox, including a high‑severity flaw that can expose Virtual Network Computing (VNC) access on all interfaces.

The advisories, published by the Fortinet Product Security Incident Response Team (PSIRT) on July 14, 2026, cover a mix of unauthenticated and authenticated issues ranging from HTTP header injection and reflected cross‑site scripting (XSS) to path traversal, buffer overread, and stack buffer overflow conditions.

Together they affect management, VPN, web‑filtering and sandboxing components that are widely used in enterprise and service‑provider environments.

Fortinet patches 7 critical flaws

The most critical item, tracked as CVE‑2026‑59835, is classified as a high‑severity exposure‑of‑resource‑to‑the‑wrong‑sphere vulnerability (CWE‑668) in FortiSandbox.

Fortinet indicates the flaw can leave VNC access exposed on every interface, potentially allowing unauthenticated remote attackers to reach VNC services. Systems running FortiSandbox versions 5.25.2, 5.05.0 or 4.44.4 should be prioritized for patching, particularly where appliance management or VNC consoles are reachable from untrusted networks.

An exposed VNC endpoint creates a low‑friction route for remote code execution or lateral movement when combined with weak authentication or reused credentials.

A separate medium‑severity issue, CVE‑2026‑59839, affects the command‑line interface (CLI) of FortiOS, FortiPAM and FortiProxy.

This authenticated path traversal vulnerability allows privileged users to manipulate pathname handling and delete files from the root filesystem.

While exploitation requires valid credentials, its destructive potential underscores the need for strict privilege separation, role‑based access control, and focused monitoring of administrative CLI sessions until patches are deployed.

Fortinet also fixed two low‑severity HTTP header injection/response‑splitting flaws, CVE‑2025‑62675 and CVE‑2025‑62826, that impact the Web Filter warning page and the captive portal authentication form respectively.

These issues arise from improper neutralization of carriage return and line feed sequences in HTTP headers and could enable unauthenticated attackers to craft malicious HTTP responses or inject headers under certain conditions.

Though lower severity, such weaknesses can be leveraged for session fixation, cache poisoning, or phishing redirection chains.

Additional weaknesses include an unauthenticated reflected XSS in SSL‑VPN interfaces (CVE‑2026‑23573) and an authenticated stack‑based buffer overflow in Log Report functionality (CVE‑2026‑59837), both rated medium.

The reflected XSS could be used to target remote users of SSL‑VPN portals, while the buffer overflow may be exploitable by authorized users to induce crashes or execute arbitrary code depending on the runtime environment and mitigations in place.

The final item in the set, CVE‑2025‑43892, is an authenticated buffer over‑read affecting authd and wad daemons in FortiOS, FortiProxy and FortiSASE that could cause information leakage or stability issues when triggered by privileged actions.

Fortinet advises administrators to identify affected appliances and apply the vendor‑recommended fixed releases via Fortinet’s Upgrade Path Tool. In addition to patching, organizations should restrict exposure of administrative interfaces, SSL‑VPN endpoints, GUI consoles and VNC services to trusted networks and management VLANs.

Security teams are also urged to review logs for anomalous SSL‑VPN requests, captive portal activity, unexpected CLI commands or file deletion events, and any unauthorized VNC connections.

Where credentials are shared or privileged accounts are used infrequently, immediate credential rotation and enforcement of multi‑factor authentication are prudent mitigations.

Given the mix of unauthenticated and authenticated attack vectors and the presence of an exposed VNC risk, security teams should treat the Fortinet advisories as operational priorities and coordinate patch windows to minimize management downtime while restoring a hardened perimeter posture.