Back www.fortiguard.com

FG IR 26 133

www.fortiguard.com • May 15, 2026

An OS command injection vulnerabtility [CWE-78] in FortiAP and FortiAP-W2 cli may allow an authenticated attacker to execute unauthorized code or commands via a specifically crafted cli command.

2026-05-12: Initial publication

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Command Injection Vulnerabilities in Fortinet Products Fortinet has disclosed two critical vulnerabilities affecting its FortiAP and FortiMail products. The first, an OS Command Injection vulnerability in FortiAP, allows authenticated attackers to execute unauthorized commands via crafted CLI requests. The second, an SQL Injection vulnerability in FortiMail, similarly permits execution of unauthorized commands through specially crafted HTTP or HTTPS requests. Both vulnerabilities are classified under CWE-78 and CWE-89 respectively. They potentially allow privileged attackers to compromise systems if exploited. The vulnerabilities were initially published on May 12, 2026, and are currently under investigation. Users are advised to monitor for updates and apply patches as they become available. 68

Extracted Entities

FG IR 26 133

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (2)