Fortinet has released critical security updates for vulnerabilities in its Wireless LAN Manager (FortiWLM) and FortiManager products, urging immediate patching to prevent exploitation. The most severe vulnerability, tracked as CVE-2023-34990, with a CVSS score of 9.6/10, is a relative path traversal flaw affecting FortiWLM versions 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4. This flaw allows unauthenticated remote attackers to read sensitive files, retrieve administrator session ID tokens, and impersonate administrators, exploiting static session IDs to gain full control over vulnerable devices. The vulnerability, first reported by Zach Hanley of Horizon3.ai, can also be combined with another vulnerability (CVE-2023-48782) to achieve remote code execution (RCE). Meanwhile, Fortinet also patched a high-severity OS command injection flaw (CVE-2024-48889) in FortiManager, which could allow authenticated remote attackers to execute arbitrary code under specific conditions. These flaws, while not yet reported to be exploited in-the-wild, represent significant security risks, making it crucial for users to update FortiWLM to versions 8.6.6 or 8.5.5 and FortiManager to its latest patched versions to protect their systems. CTIX analysts recommend that any affected administrators ensure that they are running the most recent secure patch to prevent future exploitation of these flaws.