Back fortiguard.fortinet.com

FG IR 26 131

fortiguard.fortinet.com • May 13, 2026

An improper neutralization of special elements used in an OS command ("OS Command Injection") vulnerability [CWE-78] in FortiAP, FortiAP-U & FortiAP-W2 CLI may allow an authenticated privileged attacker to execute unauthorized code or commands via crafted CLI requests.

2026-05-12: Initial publication

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Command Injection Vulnerabilities in Fortinet Products Fortinet has disclosed two critical vulnerabilities affecting its FortiAP and FortiMail products. The first, an OS Command Injection vulnerability in FortiAP, allows authenticated attackers to execute unauthorized commands via crafted CLI requests. The second, an SQL Injection vulnerability in FortiMail, similarly permits execution of unauthorized commands through specially crafted HTTP or HTTPS requests. Both vulnerabilities are classified under CWE-78 and CWE-89 respectively. They potentially allow privileged attackers to compromise systems if exploited. The vulnerabilities were initially published on May 12, 2026, and are currently under investigation. Users are advised to monitor for updates and apply patches as they become available. 68

Extracted Entities

FG IR 26 131

The full story

Extracted Entities

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (3)

Vulnerabilities (1)