CVE-2026-21643

CVE-2025-52436, with a CVSS score of 8.8 (High), is an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FortiSandbox which may allow an unauthenticated attacker to execute commands via crafted requests. CVE-2026-22153, having a CVSS score of 8.1, is an Authentication Bypass by Primary Weakness vulnerability in FortiOS fnbamd. Its exploitation may allow an unauthenticated attacker to bypass LDAP authentication of Agentless VPN or FSSO policy, under specific LDAP server configuration. CVE-2025-68686, with a CVSS score of 5.9, is an Exposure of Sensitive Information to an Unauthorized Actor vulnerability in FortiOS SSL-VPN which may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. UPDATE (2026-07-28) CISA added CVE-2025-68686 to its KEV list indicating active exploitation. The critical vulnerability previously patched, CVE-2026-21643, is an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiClientEMS which may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

EPSS 94.09% · 99.8th percentile