Fortinet PSIRT Monthly Advisories — October 2023

Exploited 0

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

None of this release's vulnerabilities is known to be exploited so far.

Critical 5

• Critical 9.7
  CVE-2023-34992 Public exploit Scanner template A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized …
  EPSS 82%
• Critical 9.6
  CVE-2023-34993 Scanner template A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through…
  EPSS 21%
• Critical 9.6
  CVE-2023-36547 A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through…
  EPSS 2.5%
• Critical 9.6
  CVE-2023-36548 A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through…
  EPSS 2.5%
• Critical 9.6
  CVE-2023-36550 A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through…
  EPSS 2.5%

All vulnerabilities 29