Recently active topics

Has anyone run into this error when registering FortiClient to EMS Cloud using Google Workspace SAML?Error: 403 - app_not_configured_for_userEnvironment:FortiClient EMS Cloud Google Workspace SAML authentication FortiGate 90G HA pairAlready verified:User access set to ON for all users in Google Admin Attribute mapping is correct ACS URL and Entity ID match between EMS and Google SAML app Not in test modeStill getting the 403 on registration. Anyone else hit this and found a fix?

Hi,What issues could there be in a split-brain scenario? I realize the raw logs sync wouldn't be a problem, but what about configs? For instance, an admin adds some devices to one node while another admin adds new devices to the other node. How can the Geo-redundant HA reconcile those changes? Can that damage Analyzers and Collectors?

Sometime we facing issue the client suddently disconnect from the network and i got below error.Is the fnac reject the client request? This is not permanent issue because if i re-plug the cable then the client can connect again 

DescriptionThis article describes on how to check for information related to a specific WAF Signature ID update or modification on the FortiGuard Labs portal.ScopeFortiWeb and FortiWeb VM.SolutionGot to FortiGuard LabsSelect the search icon at the top right of the portal.Enter the Signature ID and prefixes it with 1 and select searchExample 1: Signature ID 040000213Example 2: Signature ID 090502602

DescriptionFortiGuard Labs has observed exploitation attempts targeting CVE-2026-85706, a critical path traversal vulnerability affecting GitLab Community Edition and Enterprise Edition.GitLab is a DevSecOps platform used for source code management, CI/CD, and software development workflows.CVE-2026-85706 is a critical path traversal vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE) that allows an unauthenticated attacker to read arbitrary files from the affected server, potentially exposing sensitive data and credentials.The following versions of GitLab are affected by CVE-2026-85706:18.7 <= Version < 18.11.1219.0 <= Version < 19.0.919.1 <= Version < 19.1.819.2 <= Version < 19.2.619.3 <= Version < 19.3.2CVE ID    CVE-2026-85706FortiNDR Cloud CoverageFortiNDR Cloud v26.3.a+Detection Rule NameCategoryPrimary MITRE IDFortiGuard Outbreak Alert: GitLab CE/EE Repository Commits Path Traversal - CVE-2026-85706Attack: ExploitationT1190 -

DescriptionFortiGuard has observed active exploitation attempts targeting Orkes Conductor deployments affected by CVE-2026-58138.Orkes Conductor is a workflow orchestration platform for managing processes across microservices, APIs, applications, and AI systems.CVE-2026-58138 is an unauthenticated remote code execution vulnerability that allows attackers to submit malicious workflows and execute arbitrary commands, potentially resulting in full server compromise.The following versions of Orkes Conductor are vulnerable to CVE-2026-58138:3.21.21 <= Version < 3.30.2CVE ID    CVE-2026-58138FortiNDR Cloud CoverageFortiNDR Cloud v26.3+Detection Rule NameCategoryPrimary MITRE IDFortiGuard Outbreak Alert: Orkes Conductor Evaluator Remote Code Execution - CVE-2026-58138Attack: ExploitationT1190 - Exploit Public-Facing ApplicationPlaybook N/AThreat HuntingFortiNDR Cloud users can use the following IOCs from Fortinet to hunt for “Orkes Conductor Evaluator Remote Code Execution” related acti

https://fortiguard.fortinet.com/psirt/FG-IR-26-156FG-IR-26-156 (CVE-2026-70465) advisory states the fix is available in FortiClient Windows 7.4.4 / 7.2.12 and later. However, the free VPN-only agent has not received a new release since 7.4.3 (per the community note that v7.4.4–7.4.8 include no new free VPN-only build).Could you confirm: 1. Is FortiClient Free VPN-only 7.4.3 (build 4726) vulnerable to CVE-2026-70465? 2. If yes, will a patched free VPN-only build be released, or is upgrading to a licensed version the only path to remediation? Thanks in advance.

We are currently evaluating our options and already have a quotation prepared for a licensed FortiClient solution, which is awaiting final approval and signature. Our organization has two FortiGate firewalls with active licenses and has been using FortiClient VPN Free Edition 7.4.3.4726 as our VPN client.Approximately 20 days ago, one of our security partners advised us to remove or upgrade FortiClient VPN 7.4.3 due to a reported vulnerability. As a result, we upgraded to FortiClient VPN 7.4.8. However, we later discovered that this version appears to require FortiClient EMS for ongoing management, leaving us uncertain about the most appropriate temporary solution.We have been unable to determine whether FortiClient VPN Free Edition 7.4.3.4726 remains secure for continued use. The software is still available for download, and discussions in community forums appear to reference different CVEs than the ones currently under review.As part of our evaluation process, we would like to unders

Hello,We have a large amount of FortiGates running 7.4 with automatic patch updates.Different kinds of models, but mostly entry-level ranging from 40F to 100F and 50G to 90G.We are looking to upgrade these manually to 7.6 and keeping automatic patch updates on.I am going back an forth between 7.6.6 and 7.6.7, as public opinion varies greatly between these, and according to release notes they both have different issues.Anyone out there know if 7.6.7 is included in the automatic patch updates, or if this still sits with 7.6.6?

This has been asked many times about - so, today Fortinet released CVE-fixing updates to its regular paid version, AND free VPN-only 7.4.3. The version number does not change - only built version. Announcement today: 

We are a new customer running FC 7.4.8 on 400+ Tahoe 26.6 Macs. We need to verify if Macs can be auto-updated from our EMS (Example: When 7.4.9 drops, can our Macs get updated silently/automatically like other popular VPN/Security solutions)? I'm unable to find any official documents on this.

Hi,Our FortiGate 80F-POE is on version 7.4.11. We plan to upgrade to next higher version 7.6.x. Can someone help me identify which is the most  stable and least vulnerable version in 7.6.x?Thanks,Sanjay

DescriptionThis article describes how to calculate and compare MD5 checksums of image files, database backups, and migration archives on FortiNAC and Windows to identify file changes during download or transfer.ScopeFortiNAC CentOS and FortiNAC-F.SolutionCompare the MD5 checksum before and after transferring a file between FortiNAC and Windows.For backup files, calculate the reference checksum from the completed original backup before transferring it. Wait until backup creation, download, or transfer has finished before performing the comparison.Calculate the MD5 checksum on FortiNAC.Connect to the FortiNAC appliance through SSH or the console.For FortiNAC-F running FortiNAC-OS, log in as admin and enter the shell:execute enter-shellRun the applicable command below. Replace the example filename and path with the actual file being checked.Image file:md5sum "/bsc/campusMgrUpdates/image.out"Example output:fnac1-thomas:/bsc/campusMgrUpdates$ md5sum "/bsc/campusMgrUpdates/FNAC_ESX-v7-build6

DescriptionThis article describes how to configure a FortiSwitch Port level Access Control List (ACL) in FortiManager. The FortiSwitch feature is described in: FortiSwitch security -> Configuring an ACL.Note: Not to be mistaken with the Firewall Access Control List (ACL) used in the policy packages, described here: How to configure Firewall Access Control Lists in FortiManager.ScopeFortiManager 7.4 and above.SolutionGo to FortiSwitch Manager -> ACL Assignment -> Create New -> ACL Ingress and configure the ACL entry. For example:Go to Create New -> ACL Group and add the ACL Ingress from step 1 to it:Under FortiSwitch Manager -> FortiSwitch Templates, edit the template of the target FortiSwitch:Select and Edit the respective FortiSwitch port and add the ACL Group:Use the Install Wizard to push the changes to the FortiGate managing the modified FortiSwitch.

DescriptionThis article describes how to manually import an LDAP user to FortiNAC and assign it to a host in the Hosts view.ScopeFortiNAC-F.SolutionMake sure LDAP connection exists between FortiNAC and LDAP server. There is no need to import the user group to read the user, FortiNAC needs to be able to read the user DN.To import an existing host from LDAP server to FortiNAC, navigate to Users & Hosts -> User Accounts -> Select 'Add New; enter the LDAP user account example 'aduser1'. After entering the username, click anywhere else on the page: a message will appear stating it was 'Loaded from Directory'. Assign the user account a Role and select Ok.Navigate to Users & Hosts -> Hosts and edit the host.

DescriptionHow to solve a firmware upload failure when upgrading a FortiGate-60F to FortiOS 7.6.7 or FortiOS 7.6.8 by uploading the firmware image through the GUI.ScopeFortiGate-60F.SolutionSummary:When upgrading a FortiGate-60F to FortiOS 7.6.7 (build 3704) by uploading the firmware image through the GUI, the upgrade displays the following message:This message indicates Fortinet cannot verify the authenticity of this firmware, the image checksum from the support portal validates, and after acknowledging the warning the upgrade completes successfully. After an upgrade, get system status shows Firmware Signature: certified. The firmware is genuine; the warning is spurious.Root cause 1:The defect is in the GUI multipart upload parser, not in the firmware image or the signature itself.In multipart_buffer_read() (fortiweb/modules/ApacheUpload.c:545), which services the firmware upload endpoint POST /api/v2/monitor/firmware/fortigate/upload:When the multipart boundary lies beyond the curren

DescriptionThis article describes a scenario where specific logs are available in the FortiGate local log database but are not received or displayed on FortiAnalyzer, even though other logs from the same FortiGate are successfully forwarded. It explains how to identify FortiAnalyzer logging filters configured on the FortiGate, determine whether Log ID-based filtering is preventing specific logs from being forwarded, and troubleshoot and resolve the issue.ScopeFortiGate, FortiAnalyzer.SolutionVerify that the affected log is available in the FortiGate local logs.Identify the affected event and note its Log ID, timestamp, log type, source, destination, and other relevant fields.Check the FortiAnalyzer logging configuration on the FortiGate:show full-configuration log fortianalyzer filterIf VDOMs are configured, verify the configuration in the relevant VDOM:config vdom edit <vdom-name> show full-configuration log fortianalyzer filter endReview the output for filters that

DescriptionThis article describes how to change the administrative port of FortiMail.ScopeFortiMail.SolutionNavigate to System -> Configuration -> Option -> Administration Port -> HTTPS port number, HTTP port number, SSH port number, TELNET port number.Under HTTPS port number, set the desired port and select Apply.Under HTTP port number, set the desired port and select Apply.Under SSH port number, set the desired port and select Apply.Under TELNET port number, set the desired port and select Apply.The FortiMail HTTPS GUI can then be accessed using the new port number through https://<FortiMail IP>:<port number>/admin. For example: https://x.x.x.x:x443/admin.Note: Changing the HTTPS port from the default value affects access to the Administrative GUI (HTTPS), REST API, quarantine service, and Webmail (server mode only). Note:Before making any changes, create a backup.To change HTTPS, HTTP, SSH, and TELNET ports in the CLI, use 'config system global'. See the docu

DescriptionThis article describes the difference between the 'Client ID' and 'Custom Tracking ID' fields in FortiWeb traffic logs and explains why a Client ID may be present while the Custom Tracking ID is 'none'.ScopeFortiWeb.SolutionFortiWeb traffic logs can display both 'Client ID' and 'Custom Tracking ID'. These fields represent different tracking mechanisms and should not be considered interchangeable.Client ID: An identifier used by FortiWeb to track a client. In the example below, FortiWeb's 'cookiesession1' cookie is used to maintain client identification.Custom Tracking ID: An identifier generated according to the match conditions configured in a Custom Tracking policy. In this example, the tracking condition uses an application session cookie.The following lab setup demonstrates the behavior:Configure Custom Tracking using an application session cookie.The backend application uses a cookie named 'LABSESSION' to maintain authenticated sessions.Configure a Custom Tracking polic

orgin->sink: org pre->post, reply pre->post dev=1->2/3->1 gwy=x.x.x.x/0.0.0.0Traffic goes from LAN to ISP1, then returns from ISP2. We are doing BGP with both ISPs and advertising our public range out of both, so the "internet" is preferring to come back (due to BGP mechanisms) ISP on dev=3. How come the Fortigate is allowing this flow? I know it is allowing it, its working perfectly, but im just curious as to what I am missing here, as I thought that if traffic comes from a different interface that it went out, fortigate will block it.Note ISP1 and ISP2 are part of the same SDWAN zone. maybe this is why? still not sureAlso the session was offloaded indeed.

Hello,I’m creating this Topic because I’m facing an issue that neither me, Dell or our Forticlient provider faced before and we both have no idea what exactly is going on. We ordered a batch of Dell Computer Pro 3 14260. Those computers are facing kernel boot trap double fault with fortishield.sys. It occurs most of the time when the computer is booting with Forticlient 7.2.15.1309, but also very often when connecting or disconnecting of Forticlient. We also tried with 7.2.14 and 7.2.13 with same issueOur EMS is in 7.2 so we can’t try 7.4 for now it’s ongoing we have to build a linux machine for the upgrade.We don’t have this problem with any other dell computer model Of course if I don’t have Forticlient installed I don’t have any issueI’m trying to compare the components for those computers and see what could be conflicting but extremely difficult  I just know it’s something with fortishield.sys as it is mentioned in the minidumps If anyone faces this (no result on forum search) or h

DescriptionHow to delete the VDOM using FortiManager when the management VDOM is not present in the same ADOM as the target VDOM.ScopeFortiManager.SolutionFortiManager enforces a device/VDOM model constraint that prevents deleting a VDOM while its management VDOM resides in a different ADOM. This article explains the constraint and provides two practical workarounds.FortiManager's ADOM (Administrative Domain) architecture determines how VDOMs are assigned and managed. In Normal Device Mode, all VDOMs from a single FortiGate must be placed in the same ADOM. In Advanced Device Mode, individual VDOMs from the same FortiGate can be assigned to separate ADOMs, enabling multi-tenant management.The deletion restriction occurs because FortiManager's device database tracks the management VDOM's ADOM assignment. When the management VDOM is in a different ADOM than the target VDOM, FortiManager cannot process the deletion through its normal device database operations. This is consistent with expe

DescriptionThis article describes an issue where STP ports move to the discard state after running the 'diagnose sys stp restart' command.When this occurs, ports that were previously forwarding traffic remain in the discard state and traffic through the affected virtual switch is interrupted.The issue can be seen when STP is enabled on virtual switches assigned to different VDOMs.ScopeFortiGate, FortiOS 7.6.SolutionThe behavior can be reproduced with multiple virtual switches using the same physical switch, with STP enabled on the corresponding interfaces.In the following example, two virtual switches are configured. Each virtual switch contains two physical ports.The virtual-switch configuration is:config system virtual-switch edit "internal-vdomA" set physical-switch "sw0" config port edit "port1" next edit "port2" next end edit "internal-vdomB" set physical-switch "sw0" config port

DescriptionThis article describes the reason why the FortiDLP agent has differing version components since 12.3.2.ScopeFortiDLP Agent, Directory sourceOverviewEach user imported from a directory service, such as Entra ID, Google Workspace, or LDAP, is assigned one or more URIs by the FortiDLP Console. These URIs uniquely identify the user and allow their activity to be attributed to them. FortiDLP supports multiple URI schemes, and the sync source determines which of these are applied to a given user.Recommendation: Enable 'Sync username mapping' so that an additional username URI is created for each imported user. This improves the likelihood of matching login events to the correct user.How User URIs Are Used:FortiDLP uses user URIs to reference different types of identifiers, which allows events to be correlated with a user.When a synced user logs in to a machine that has the FortiDLP Agent installed, using either their username or email address, the following occurs:The Agent record

Description This article describes how to limit concurrent user authentication.  Scope FortiOS v7.x to v8.x.Solution The same user can be used for multiple concurrent authentications. Its maximum number can be limited globally or per user-group only via CLI.Globally: config system global     set policy-auth-concurrent 10 end Per user-group: config user group     edit <group-name>         set auth-concurrent-override enable         set auth-concurrent-value <number_of_max_concurrent_users>     next endNote:SAML user groups are not affected by the auth-concurrent settings, and the concurrent sessions of SAML users should be managed with the IdP.