FORTINET-PRODUCTS-A1186039008D4FE9 release notes and known issues

Arbitrary log file read in administrative interface

Scope: Fortinet products. This update record adds version, fix and known-issue context. Its publication date is not a lifecycle boundary.

Summary

CVSSv3 Score: 4.0 An Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability [CWE-88] in FortiDeceptor WEB UI may allow an authenticated attacker with at least read-only admin permission to read log files via HTTP crafted requests. Revised on 2026-05-12 00:00:00

Improvements and security content

CVSSv3 Score: 4.0 An Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability [CWE-88] in FortiDeceptor WEB UI may allow an authenticated attacker with at least read-only admin permission to read log files via HTTP crafted requests. Revised on 2026-05-12 00:00:00

Known issues

Publisher statement

Not stated. The verified publisher record does not contain a known-issues statement.

Affected products and versions

Products

Fortinet products

Affected versions

Fixed versions or updates

No fixed version is stated in this record.

Recommended action

Review the official publisher document before deployment.

Official publisher evidence

FORTINETVERIFIED

Arbitrary log file read in administrative interface

Checked 8 Oct 2026. BlackTree preserves the last verified facts if a later source check is temporarily unavailable.

Open the official publisher source