VULNpocalypse
MediumVulnerabilityMonitoring

HKCERT reports multiple Fortinet product vulnerabilities (medium risk)

HKCERT reports multiple Fortinet product vulnerabilities rated medium risk; check the Fortinet PSIRT advisories and apply vendor fixes.

Published
Fixed in
Vendor fixes are referenced in Fortinet PSIRT advisories FG-IR-26-190 to FG-IR-26-277; specific fixed versions not confirmed
Exploitation
Not confirmed. The HKCERT bulletin does not report exploitation in the wild.

Live scores

CVE-2025-61625
EPSS
0.007
low predicted chance of attack
VEDAS
0.058
little exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-26248
EPSS
0.006
low predicted chance of attack
VEDAS
0.054
little exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

What happened

According to HKCERT, the Hong Kong computer emergency response team, multiple vulnerabilities were identified in Fortinet products. In a bulletin released on 11 November 2026, HKCERT rates the risk as Medium and classes the type as Operating Systems - Networks. HKCERT

HKCERT says a remote attacker could exploit some of these vulnerabilities to cause denial of service, elevation of privilege, security restriction bypass, sensitive information disclosure, remote code execution, data manipulation and spoofing on the targeted system. Its impact list also includes cross-site scripting. HKCERT

The bulletin points to Fortinet PSIRT advisories numbered FG-IR-26-190 through FG-IR-26-277, and the list skips some numbers. It also lists many CVE identifiers, including CVE-2025-61625, CVE-2026-26248 and CVE-2026-121526. The CVE list is truncated in the source text available to us, so the full set is not confirmed here. HKCERT

Not confirmed: which Fortinet products and versions each issue affects, which CVE maps to which impact, and whether any issue is exploited in the wild. The bulletin does not state these details.

Am I affected?

HKCERT does not list affected products or versions itself. It refers readers to the Fortinet PSIRT advisories for that. HKCERT If your organisation runs Fortinet products, review those advisories to see which apply to your deployment. If you do not use Fortinet products, the bulletin gives no reason to act.

What to do now

  1. Inventory the Fortinet products and versions you run.
  2. Open the relevant Fortinet PSIRT advisories from the range FG-IR-26-190 to FG-IR-26-277, using the list in the HKCERT bulletin, and compare them against your inventory.
  3. Apply the fixes issued by the vendor, as HKCERT advises. HKCERT also says to visit the vendor website for details before installation. HKCERT
  4. Re-check the vendor advisories for updates, since fixed versions are not confirmed in the HKCERT bulletin.

Sources