Fortinet security advisory (AV26-351)

Serial number: AV26-351
Date: April 14, 2026

On April 14, 2026, Fortinet published security advisories to address vulnerabilities in multiple products. Included were critical updates for the following:

• FortiSandbox 4.4 – versions 4.4.0 to 4.4.8
• FortiSandbox 5.0 – versions 5.0.0 to 5.0.5
• FortiAnalyzer Cloud 7.6 – versions 7.6.2 to 7.6.4
• FortiManager Cloud 7.6 – versions 7.6.2 to 7.6.4
• FortiDDoS-F 7.2 – versions 7.2.1 to 7.2.2

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• OS Command Injection through API endpoint
• Unauthenticated Authentication bypass and Privilege escalation in FortiSandbox
• Heap-based buffer overflow in oftpd daemon
• SQL Injection via API
• Fortinet PSIRT Advisories