Loading story…
A high-severity SQL injection vulnerability, tracked as CVE-2025-58692, was discovered in Fortinet FortiVoice, a Voice-over-IP (VoIP) solution used by enterprises. The flaw affects FortiVoice versions 7.0.0 through 7.0.7 and 7.2.0 through 7.2.2, allowing remote, authenticated attackers to inject arbitrary SQL statements via specially crafted HTTP or HTTPS requests. Successful exploitation could result in arbitrary code execution, potentially leading to full system compromise. Fortinet has released patches, recommending users upgrade to FortiVoice 7.0.8 or newer and 7.2.3 or newer to mitigate the risk.
Security advisories and vulnerability databases have highlighted the critical nature of this issue, assigning it a CVSS score of 8.8. Organizations are urged to identify and update vulnerable FortiVoice installations promptly. Tools and queries are available to help administrators locate at-risk systems within their networks. No evidence of active exploitation has been reported as of the latest advisories, but the potential impact underscores the importance of immediate remediation.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
runZero published a blog post explaining how defenders can find Fortinet FortiVoice installations on their networks. The post represents a defensive response aimed at helping organizations assess exposure after the vulnerability disclosure.
A high-severity CVE entry for CVE-2025-58692 was published, identifying a Fortinet FortiVoice SQL injection vulnerability. The CVE publication formalized public tracking of at least one of the disclosed flaws.
Fortinet published advisory FG-IR-25-666 describing SQL injection vulnerabilities affecting the voice and administrative interfaces in FortiVoice. This appears to be the initial public disclosure of the issue set.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
fortiguard.fortinet.com
Open sourcerunzero.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fortinet disclosed **CVE-2025-53681**, an SQL injection flaw in the FortiMail administrative portal that could let an authenticated, privileged attacker execute unauthorized code or commands on the email gateway through crafted HTTP or HTTPS requests. The vulnerability stems from improper neutralization of special elements in SQL commands (`CWE-89`) within the admin GUI, and Fortinet said it was discovered internally by Jaguar Perlas of the Fortinet Burnaby InfoSec team. Affected versions are FortiMail **7.6.0 through 7.6.3**, **7.4.0 through 7.4.5**, and **7.2.0 through 7.2.8**. Fortinet advised customers to upgrade to **7.6.4**, **7.4.6**, or **7.2.9** and later, while **FortiMail 8.0** is not affected. Fortinet rated the issue **Medium** with a CVSS v3 score of **6.3**, while the NVD scored it **7.2**; Fortinet said it had **no evidence of in-the-wild exploitation** at the time of disclosure.
Jul 10, 2026
Fortinet has disclosed several high-severity vulnerabilities affecting its security product lines, including FortiWeb, FortiVoice, and FortiSandbox. Notable issues include a cookie forgery vulnerability in FortiWeb (CVE-2025-64447) that allows unauthenticated attackers to execute arbitrary operations via forged cookies, provided they know the device's serial number, and an improper verification of cryptographic signatures in FortiWeb (CVE-2025-59719) that enables unauthenticated attackers to bypass FortiCloud SSO login authentication using crafted SAML responses. Additionally, FortiVoice is impacted by a path traversal vulnerability (CVE-2025-60024) permitting privileged authenticated attackers to write arbitrary files, and FortiSandbox suffers from an OS command injection flaw (CVE-2025-53949) that allows authenticated attackers to execute unauthorized code on the underlying system through crafted HTTP requests. All vulnerabilities are remotely exploitable and have been assigned high or critical CVSS scores, with the FortiWeb authentication bypass rated as critical (CVSS 9.8/10). Fortinet has released security advisories and patches for the affected versions, urging customers to update their systems promptly to mitigate the risk of exploitation. Security researchers and vendors have highlighted the urgency of these patches due to the potential for unauthenticated remote attacks and the critical role these products play in enterprise security architectures.
Jun 29, 2026
Fortinet disclosed two high-severity vulnerabilities affecting **FortiSandbox** and **FortiDDoS-F**, both of which could allow unauthorized code or command execution. **CVE-2026-39808** is an OS command injection flaw in FortiSandbox versions `4.4.0` through `4.4.8`, mapped to `CWE-78`, with a `CVSS 3.1` vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, indicating remote exploitation without authentication and high impact across confidentiality, integrity, and availability. Fortinet also disclosed **CVE-2026-39815**, an SQL injection vulnerability in FortiDDoS-F versions `7.2.1` through `7.2.2`, mapped to `CWE-89`. The flaw requires low privileges but may likewise enable unauthorized code or command execution, and carries a `CVSS 3.1` vector of `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`. The issues are tracked in Fortinet advisories **FG-IR-26-100** and **FG-IR-26-119**, respectively, expanding the vendor's latest set of appliance security fixes.
Jun 29, 2026