[NCSC-NL-DFIR]

Fortinet's 5 November update to FG-IR-26-186 confirms that FortiSOAR and FortiSOAR PaaS are affected by CVE-2026-109618 and CVE-2026-109619 and identifies released remediation. Both existing inventory entries now change from Investigation to Fix for both CVEs, restricted to the documented fixed release and security-patch scopes.

Product	Previous status	New status for both CVEs	Fixed scope
FortiSOAR (PHP-0682)	Investigation	Fix	8.0.1 or later; 8.0.0 with Security Patch #2; 7.6.7 or 7.5.4 with Security Patch #1
FortiSOAR PaaS (PHP-0683)	Investigation	Fix	8.0.1 or later; 8.0.0 with Security Patch #2; 7.6.7 or 7.5.4 with Security Patch #1

Fortinet limits confirmed impact to denial of service affecting the PHP service and GUI availability (product CVSS 3.1: 5.3). The patch documentation confirms an update to PHP 8.2.35. Unpatched versions remain affected; 7.6.8 and 7.5.5 are still labelled upcoming and are not claimed as released fixes. Patch availability does not establish installation on individual systems or PaaS tenants.

Official public evidence reviewed on 6 November 2026:

• Fortinet PSIRT FG-IR-26-186, updated 5 November: both CVEs, both products, affected releases, remediation and product-specific impact.
• FortiSOAR 8.0.0 Security Patch #2.
• FortiSOAR 7.6.7 Security Patch #1.
• FortiSOAR 7.5.4 Security Patch #1.

The review started from current main, 6673c70, and was limited to the 94 entries with at least one Investigation assessment. Public vendor/upstream searches did not establish another sufficiently specific new status change. The remaining 92 entries retain their assessments. In particular, FortiDDoS remains under investigation; FortiDDoS-F's unaffected statement is a separate product scope. Generic application or deployment entries were not assigned a fix from a separate Docker, runtime or hosted-service record.

Source changes update the existing SPDX fragments, preserve package identifiers and separate the four fixed assessments from the shared investigation assessments. The remaining FortiDDoS assessments move to the owning edge-device segment with their IDs and compiler order preserved. No new files or folders were added. All Markdown, history, README tables and statistics were regenerated according to AI.md.

Validation completed using the existing virtual environment:

• python tools/build_spdx_inventory.py
• python -m json.tool software/spdx/PHP_Downstream_Inventory.spdx3.json
• python tools/generate_software_list_from_spdx3.py PHP_Downstream_Inventory.spdx3.json -o software --update-history --update-readme --history-ref origin/main
• python tools/generate_inventory_statistics.py --history-ref origin/main
• python tools/build_spdx_inventory.py --check
• git diff --check
• Semantic comparison confirms exactly four status changes, limited to the two product records, and no package additions or removals.
• Reviewed the generated five-row latest-updates table, single newest-first history table, unchanged operational timestamp, and statistics PNG/JSON for the 2, 4 and 6 November update dates. Fixed count increases from 185 to 187; all other product statuses remain unchanged.

Historical row timestamps refresh from the fetched mainline commit history; historical product/status contents are preserved. This PR is submitted for human review and has not been approved or merged.