Fortinet FortiGuard PSIRT advisories

https://www.fortiguard.com/psirt

Added 2026-09-29: first-party PSIRT for FortiOS / FortiProxy / FortiWeb / FortiManager and the rest of the Fortinet estate, the most frequently KEV-listed edge vendor; only the FortiGuard research blog existed as a source before. RECIPE: `feed https://filestore.fortinet.com/fortiguard/rss/ir.xml 20` (direct; FG-IR-26-164/165/167 dated 2026-09-08 at probe), then `extract https://www.fortiguard.com/psirt/FG-IR-YY-NNN` for the version table and the 'exploited in the wild' statement. (2026-09-29 operator-directed setup review) | 2026-10-03 S1: `feed https://filestore.fortinet.com/fortiguard/rss/ir.xml` falls to the reader and loses dates; `python3 tools/fetch_source.py url --direct https://filestore.fortinet.com/fortiguard/rss/ir.xml` returns the full XML with pubDate per item (50 items). Read the advisory with `extract https://fortiguard.fortinet.com/psirt/FG-IR-26-NNN`; the page body is the summary, workaround and IoC lists (the added/modified file table that BleepingComputer reproduces did not appear in any 2026-10-03 transport read of FG-IR-26-175). (2026-10-03T0404Z-intel) | 2026-10-06 (S1, main agent verified on FG-IR-26-175): the advisory HTML's 'Download CSAF' href (filestore.fortinet.com/fortiguard/psirt/csaf_<slug>_fg-ir-26-NNN.json, readable with `url --direct`) gives current_release_date and structured remediations; the page's Timeline block names revisions ('2026-10-05: Solution update'), which the RSS pubDate does not. | 2026-10-12: S1: `feed https://filestore.fortinet.com/fortiguard/rss/ir.xml 15` read direct (15 dated items), not through the reader; the list carries advisory-creation dates only, so revisions need the advisory page Timeline block (`extract https://fortiguard.fortinet.com/psirt/FG-IR-26-NNN` reads it direct). | 2026-10-15 (S1): the feed GET was reset on the direct transport and fell back to the reader with undated items. Per-advisory metadata (CVE id, severity, Known Exploited) is only in the raw HTML: read it with `url --direct` and strip the tags. | 2026-10-18 (S1): the Known Exploited and CVE fields appear only in the raw advisory page (`url --direct`), not in the `extract` view. | 2026-10-19 intel run S1: `url --direct https://fortiguard.fortinet.com/psirt/FG-IR-26-NNN` fails when ten are fetched in parallel (5 of 10 failed); serial fetches with a 4 s pause work. Known Exploited, Attack Type and CVSSv3 Score parse from the stripped HTML. | 2026-10-26 (S1): `url --direct https://fortiguard.fortinet.com/psirt/FG-IR-<id>` parses Published and Updated dates, Known Exploited, Timeline, and the products under investigation versus confirmed not impacted. | 2026-10-27 (S1): the record's rss_url (filestore.fortinet.com/fortiguard/rss/ir.xml) resets the connection on every transport; working recipe: `fetch_source.py feed https://www.fortiguard.com/rss/ir.xml 30` (retry once if the first call in a minute resets), then `extract https://fortiguard.fortinet.com/psirt/FG-IR-26-NNN` for the affected and not-impacted lists and the timeline. | 2026-10-29 (S1): Recipe note confirmed: first call to `feed https://www.fortiguard.com/rss/ir.xml 30` reset the connection, retry after about 20 s worked. Newest advisories: FG-IR-26-187 (2026-10-26, Node.js CVEs, products under investigation) and FG-IR-26-186 (2026-10-21, PHP2Shell: FortiDDoS, FortiSOAR and FortiSOAR PaaS under investigation, FortiOS and 28 other products not impacted). No Fortinet CVE advisories earlier than the wi | 2026-11-08 run 2026-11-08T0256Z-intel: the RSS answers connection reset; `extract https://www.fortiguard.com/psirt` lists the 15 newest advisories with IDs, CVEs, versions and dates and WebFetch agrees. | 2026-11-09 intel run: the PSIRT RSS `https://filestore.fortinet.com/fortiguard/rss/ir.xml` reads (S1; newest FG-IR-26-188, 2026-11-02) while the HTML listing is stale and omits FG-IR-26-186 to -188; prefer the feed.