Fortinet rushes Friday fix for critical FortiOS SSL VPN flaw, unauthenticated RCE possible

Fortinet released a critical security update late Friday addressing a remote code execution flaw in the SSL VPN component of FortiOS and FortiProxy, tracked as CVE-2026-37916. The bug allows unauthenticated attackers to execute code on affected appliances via crafted HTTP requests to the VPN web portal, which places edge devices that expose the portal to the internet at immediate risk.

The timing matters because Fortinet SSL VPN vulnerabilities are routinely weaponized within days, and sometimes hours, by ransomware crews and state linked groups. Security teams will want to patch or disable the portal before leaving for the weekend.

Fortinet assigned a critical severity and says multiple supported trains are affected. Fixed builds are available for FortiOS 6.4, 7.0, 7.2, and 7.4, and for the corresponding FortiProxy releases. Fortinet says FortiOS 7.4.4 and later, 7.2.7 and later, and 7.0.15 and later contain the fix, with similar updates available for long term support branches. FortiGate appliances managed by FortiManager require both device and manager updates to fully remediate.

The company says it has not observed exploitation at publication time, but it expects scanning to begin quickly due to the small attack surface and the prevalence of exposed portals. Cloud hosted FortiSASE is not impacted. Customers should verify that the SSL VPN web portal is not exposed if immediate patching is not possible. Disabling the portal, restricting access to known IP ranges, and enforcing MFA on all remote access reduce risk.

Detection guidance includes reviewing VPN appliance logs for spikes in HTTP 400 and 500 responses on /remote and related endpoints, unexpected process restarts, and newly created local admin accounts. Fortinet says updated IPS signatures are available for FortiGuard subscribers. External WAFs should block anomalous request payloads to the portal and rate limit unauthenticated requests.

This bug continues a pattern that began with CVE-2018-13379 and continued with CVE-2022-42475 and CVE-2023-27997, all of which were heavily exploited for initial access. Edge appliances remain high value targets because they sit at the trust boundary and are often exposed, so organizations running self managed VPNs should plan for rapid patch cycles, layered access controls, and continuous monitoring of internet facing services.