Fortinet
- Aliases / services
- フォーティネット / FortiGate / FortiWeb / FortiGuard / Fortinet
- Official website
- https://www.fortinet.com/
Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.
Response status by service
FortiOS
- Response status
- Unaffected
- Response information checked
- 2026-10-27
Current re-audit: Official response verified · Research date: 2026-10-27
The notice states that FortiOS itself is unaffected by these two CVEs.
Scope: This assessment of FortiOS does not apply to PHP applications behind it.
What users should do
Check and update PHP on protected servers separately.
Official service URL
Source URLs
- Using FortiGate to protect against the PHP vulnerabilitieshttps://community.fortinet.com/fortigate-3/using-the-fortigate-to-protect-against-php-vulnerabilities-cve-2026-109618-and-cve-2026-109619-230762Response evidence
FortiGate — IPS signatures
- Response status
- Mitigation guidance available
- Response information checked
- 2026-10-27
Current re-audit: Official response verified · Research date: 2026-10-27
IPS definitions 37.317 default to Pass; the October 26 addition states that 37.319 defaults to Drop.
Scope: IPS protection does not replace PHP patches.
What users should do
Verify definition versions and actual signature actions, and apply the appropriate IPS sensor and firewall policy.
Official service URL
Source URLs
- Using FortiGate to protect against the PHP vulnerabilitieshttps://community.fortinet.com/fortigate-3/using-the-fortigate-to-protect-against-php-vulnerabilities-cve-2026-109618-and-cve-2026-109619-230762Response evidence
FortiGate — OT Virtual Patching
- Response status
- Mitigation guidance available
- Response information checked
- 2026-10-27
Current re-audit: Official response verified · Research date: 2026-10-27
OT Virtual Patching has separate configuration and licensing and follows the Action configured in its profile.
Scope: Do not apply the IPS 37.319 default-Drop assumption to OT profiles.
What users should do
Check eligibility and the Action in the Virtual Patching profile.
Official service URL
Source URLs
- Using FortiGate to protect against the PHP vulnerabilitieshttps://community.fortinet.com/fortigate-3/using-the-fortigate-to-protect-against-php-vulnerabilities-cve-2026-109618-and-cve-2026-109619-230762Response evidence
Related official sources
- Using FortiGate to protect against the PHP vulnerabilitiesOfficial notice
Comments