Cybersecurity company Fortinet has released security updates to fix a number of vulnerabilities across its FortiAuthenticator, FortiSandbox, FortiNDR, FortiMail, and FortiAP products.
The first vulnerability, tracked as CVE-2026-44277, impacts FortiAuthenticator, Fortinet’s Identity and Access Management (IAM) platform. The flaw stems from an improper access control issues that could allow an unauthenticated attacker to run unauthorized code or commands through specially crafted requests.
Fortinet addressed the issue in FortiAuthenticator versions 6.5.7, 6.6.9, and 8.0.3. The company noted that FortiAuthenticator Cloud, previously known as FortiTrust Identity, is not affected by the vulnerability.
The second flaw (CVE-2026-26083) affects FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS WEB UI. The vulnerability is caused by missing authorization controls and could enable remote code execution through malicious HTTP requests without authentication. FortiSandbox products are widely used to detect and analyze malware and zero-day threats in enterprise environments.
The vendor has also patched two SQL-injection flaws in FortiNDR (CVE-2026-25088) and FortiMail (CVE-2025-53681), and a command injection issue in FortiAP (CVE-2025-53680).
At present, there are no reports that any of the above flaws is being exploited in the wild. However, organizations are strongly recommended to apply security updates ASAP.
Also, Microsoft has released its monthly Patch Tuesday security updates, addressing over a hundred flaws. This release does not fix any zero-days or previously disclosed flaws, although it does patch a number of high-risk vulnerabilities, including an RCE issue in Microsoft Windows GDI, and a bunch of code execution flaws in Microsoft Edge.