Fortinet has patched two (2) critical vulnerabilities affecting two (2) of their network cybersecurity solutions. The first flaw, tracked as CVE-2022-39952, was given a 9.8/10 CVSS score and is an external control of file name or path vulnerability impacting the FortiNAC product, a network access control solution allowing Fortinet customers to manage network access to prevent threats. If exploited, an unauthenticated attacker could perform arbitrary write operations on a vulnerable system, allowing them to make configuration changes as well as move laterally across the network. The second flaw, tracked as CVE-2021-42756, was given a CVSS score of 9.3/10 and stems from multiple stack-based buffer overflow vulnerabilities impacting the FortiWeb product. FortiWeb is Fortinet’s web application firewall (WAF) solution, which helps customers protect their internet-facing applications and APIs from web-based attacks like cross-site scripting (XSS), SQL injection, and distributed denial of service (DDoS) attacks. Threat actors could exploit this flaw by sending maliciously crafted HTTP requests, leading to arbitrary code execution. Fortinet has not provided manual mitigation techniques, and CTIX analysts recommend all network administrators responsible for vulnerable Fortinet solutions to patch their products immediately.