Fortinet PSIRT Monthly Advisories — March 2026
Tuesday, 10 March 2026
- Vulnerabilities
- 22
- Critical
- 0
- High
- 4
- Zero-days
- 0
- Public exploit
- 1
Exploited 0
Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.
None of this release's vulnerabilities is known to be exploited so far.
Public exploit code 1
Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.
- High 7.4
All vulnerabilities 22
High4 ShowHide
- High 7.7
- High 7.4
- High 7.3
- High 7.0
Medium15 ShowHide
- Medium 6.8
-
Medium 6.7
CVE-2025-66178 A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7…EPSS 1.9%
-
Medium 6.7
CVE-2026-25836 An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox Cloud 5.0.4, FortiSandbox …EPSS 2%
- Medium 6.5
- Medium 6.4
- Medium 6.3
- Medium 6.0
- Medium 5.9
- Medium 5.9
- Medium 5.6
- Medium 5.5
- Medium 5.1
- Medium 5.0
- Medium 4.6
- Medium 4.1
Low3 ShowHide
- Low 3.8
- Low 3.4
- Low 2.5