Fortinet Vulnerabilities Require Immediate Updates

CSA Alerts & Advisories (Singapore)

Published March 13th, 2026

Detected March 13th, 2026

Summary

The Cyber Security Agency of Singapore (CSA) has issued an alert regarding high-severity vulnerabilities in multiple Fortinet enterprise products. Users are strongly advised to update affected systems immediately to mitigate risks of unauthorized code execution, authentication bypass, and privilege escalation.

View original document View source feed page

What changed

The Cyber Security Agency of Singapore (CSA) has alerted users and administrators to critical vulnerabilities discovered in various Fortinet enterprise products, including FortiSwitch, FortiWeb, FortiManager, and FortiClientLinux. These vulnerabilities, identified by CVE numbers such as CVE-2026-22627 and CVE-2026-24017, could allow remote attackers to bypass authentication, execute arbitrary commands, or escalate privileges on affected devices.

Organizations utilizing the specified versions of Fortinet products must prioritize immediate updates to the latest available versions. Failure to do so could expose their networks to significant security risks, including unauthorized access and control. This advisory emphasizes the critical need for prompt patch management to maintain system integrity and prevent potential cyberattacks.

What to do next

Identify all affected Fortinet product versions within your environment.
Update all identified affected Fortinet products to the latest available versions immediately.
Consult Fortinet's security advisories for detailed remediation steps.

Source document (simplified)

Alerts

High Severity Vulnerabilities in Fortinet Products

13 March 2026

Fortinet has released a security advisory addressing multiple vulnerabilities across its core enterprise products. Users and administrators of affected products are advised to update to the latest versions immediately.

Background

Fortinet has released a security advisory addressing multiple vulnerabilities across its core enterprise products. The vulnerabilities include authentication bypass and buffer overflow flaws that may enable remote attackers to execute arbitrary commands or escalate privileges.

Impact

Successful exploitation of these vulnerabilities could allow:

CVE-2026-22627: An unauthenticated attacker within the same adjacent network to execute unauthorised code or commands on the device by sending a crafted Link Layer Discovery Protocol (LLDP) packet.
CVE-2026-24017: A remote unauthenticated attacker to bypass the authentication rate-limit via crafted requests.
CVE-2025-54820: A remote unauthenticated attacker to execute unauthorised commands via crafted requests, if the service is enabled.
CVE-2026-24018: A local and unprivileged user to escalate their privileges to root.
Affected Products

The following product versions are affected by the vulnerabilities.

For CVE-2026-22627: