Attackers have been targeting various Fortinet products for some time. A functional security update is still missing.

CISA added the flaw to its KEVs catalog as Fortinet warned that patches for most affected versions remain “upcoming,” even though vulnerable devices can no longer use cloud SSO until upgraded.

Fortinet released updates for FortiOS and other products on Wednesday night. They fix, in some cases critical, vulnerabilities.

The flaw has a critical severity rating with a CVSS score of 9.6 and allows a remote unauthenticated actor to execute arbitrary commands by specially crafted HTTP requests. Fortinet has advised users ...