On the Security Profiles > AntiVirus page, a VDOM administrator with a custom administrator profile cannot create or modify an antivirus profile belonging to the VDOM.

When UTM status is enabled and the AV profile has no configuration, all SLL traffic is dropped and there is no WAD output.

The firewall policy dialog should show the no-inspection profile and the warning should be consistent with the policy list.

FortiOS should support EMS 7.2.1 auth API status code changes.

GUI repeated calls to the EMS API, which can cause EMS to not authorize the FortiGate correctly.

When there are many users authenticated by an explicit proxy policy, the Firewall Users widget can take a long time to load. This issue does not impact explicit proxy functionality.

Sessions between the explicit proxy and server stay in SYN_SENT state when using IP pools in the explicit proxy policy for source NAT, even though the sessions have established. Traffic is not impacted.

Explicit web proxy fails to forward HTTPS request to a Squid forward server when certificate inspection is applied.

Enabling http-ip-header on virtual server changes the log produced for transparent web proxy.

Wrong source IP address used for packets through explicit proxy routed to a member of SD-WAN interface.

The Enabled On should display the listening interfaces rather than None in explicit proxy policy on the GUI.

Cannot send picture through web explicit proxy.

If the first firewall service object in the service list (based on the order in the command line table) has a protocol type of IP, the GUI may incorrectly modify its protocol number whenever a new firewall service of the same protocol type IP is created in the GUI.

This silent misconfiguration can result in unexpected behavior of firewall policies that use the impacted service. For example, some 6K and 7K platforms have firewall service ALL (protocol type IP) as the first service, and this can cause the ALL service to be modified unexpectedly.

Unable to add more MAC addresses once the MAC address group object for a VWP policy referenced.

Egress interface cannot be intermittently matched for Wake-on-LAN (broadcast) packets.

Traffic issues occur with virtual servers after upgrading.

Implicit deny policy is allowing "icmp/0/0" traffic.

Access to some websites fails after upgrading to FortiOS 7.2.3 when the firewall policy is in flow-based inspection mode.

Wrong TOS field value in NetFlow report when there is no traffic.

Optimize CPU usage caused by a rare error condition which leads to no data being sent to the collector.

UDP fragments dropped due to DF being set. Only the set honor-df global option.

New sessions are created and evaluated after a certain number of UDP packets, even if set block-session-timer 300 is set.

When running tests with SNAT PBA source and destination IP addresses, octets are shown in reverse order.

After system synchronization, primary blades' reboot command did not take effect on the secondaries.

The FortiGate 6000 or 7000 front panel does not appear on the Network > Interfaces and System > HA GUI pages.

In some cases, the FortiGate 7000F platform cannot correctly reassemble fragmented packets.

The FortiGate 6000 and 7000 System Information dashboard widget incorrectly displays the management board or primary FIM serial number instead of the chassis serial number. Use get system status to view the chassis serial number.

FortiGate 6000 and 7000 platforms do not support managing FortiSwitch devices over FortiLink.

Virtual clustering is not supported by FortiGate 6000 and 7000 platforms.

The FortiGate 6000 and 7000 platforms do not support EMAC VLANs.

Support SLBC integrated memory and disk logging in the new local logd framework.

Adding a FortiAnalyzer to a FortiGate 6000 or 7000 Security Fabric configuration from the FortiOS GUI is not supported.

On FortiGate 7000F platforms, NP7-offloaded UDP sessions are not affected by the udp-idle-timer option of the config system global command.

SNMP walk fails to get BGP routing information.

The GUI becomes unresponsive, and sometimes may work after rebooting.

Authenticated users are not synchronized to the secondary FortiGate 6000 or 7000 chassis when the secondary chassis joins a primary chassis to form an FGCP cluster.

On a FortiGate 7000F, after a new FPM becomes the primary FPM, IPsec VPN dynamic routes are not synchronized to the new primary FPM.

Sessions for IPsec dialup tunnels that are configured to be handled by a specific FPC or FPM may be incorrectly sent to a different FPC or FPM, resulting in traffic being blocked.

The FortiGate 7000E and 7000F platforms do not support GTP and PFCP load balancing.

FGCP session synchronization may not synchronize all sessions on FortiGate 6000 and 7000 models.

FortiGate 7000E IPv6 routes may not be synchronized correctly among FIMs and FPMs.

Multiple IP pools in SSL VPN is not supported.

SNMP query to fgVdEntSesRate returns a 0 value.

An uncertified warning appears only on the secondary chassis' FIM02 and FPMs.

Graceful upgrade from 7.0.12 to 7.2.5 fails sometimes due to the primary chassis not being switched over.

After an SNMP HA failover, the SNMP trap continues to work.

GUI shows Failed to retrieve FortiView data while accessing FortiView Sources and FortiView Destination.

The FortiGate may display a false alarm message TypeError [ERR_INVALID_URL]: Invalid URL in the crashlog for the node process. This error does not affect the operation of the GUI.

In an environment where the Security Fabric is enabled and there are more than 100 firewall object conflicts between the root and downstream FortiGates, the Firewall Object Synchronization pane does not list the details.

Incorrect interface is being selected in the SD-WAN Rules GUI page, but the correct one is displayed in the CLI.

When private data encryption is enabled, the GUI may become unresponsive and HA may fail to synchronize the configuration.

In the System > Administrators dialog, when there are a lot of VDOMs (over 200), the dialog can take more than one minute to load the Two-factor Authentication toggle. This issue does not affect configuring other settings in the dialog.

When using configuration save mode with VDOMs, the GUI still shows unsaved changes after another administrator commits their changes with SSH.

Changing the IPv4/IPv6 version in the dropdown of one widget will also impact other Session Rate widgets.

Network > SD-WAN > SD-WAN Zones and SD-WAN Rules pages do not load if a shortcut tunnel is triggered.

Disabling gui-wireless-controller on the root VDOM impacts other VDOMs (unable to add or show WiFi widgets on first load).

FortiGate GUI issues on mobile phone's browser.

HA secondary synchronization fails and keeps rebooting when the primary has a split port configuration.

Platforms in an HA environment get stuck in a reboot loop while attempting to synchronize configurations that differ in split ports.

When private data encryption is enabled, all passwords present in the configuration fail to load and may cause HA failures.

On a FortiGate HA cluster, both primary and secondary units are displayed as the Primary on the GUI top banner, and as Current HA mode in the CLI.

FortiGate is going to out-of-sync after changing parameters of VDOM link interfaces.

Running diagnose sys ha vlan-hb-monitor incorrectly shows inter-VDOM VLANs inactive.

Adding a VLAN interface on any VDOM causes BGP flapping and VIP connectivity issues on VDOMs in vcluster2.

HA interfaces flapping on FG-3401E.

In HA, sending lot of CLI configurations causes the creation of a VDOM on the secondary unit.

Unable to set the interface configured as an SD-WAN member to pingserver-monitor-interface in the CLI.

Cannot access out-of-band IPv6 address on HA secondary unit.

HA cluster became out-of-sync after enabling a password policy and logging on to FortiGate.

When NP7 platforms enable the GTP enhanced mode it does not use uninterruptible upgrade.

When entering the psksecret under config system standalone-cluster, no verifications are done against the password policy IPsec preshared key.

Lost management connectivity to the standby node via in-band management.

FortiGate sent ARP request with loopback IP address as the source address.

Secondary blade hostname and mgmt1 IP were changed after a restored configuration on the primary blade.

When upgrading a cluster of four FortiGate 2200E devices, each secondary forms a cluster with the primary only and causes an outage.

FortiGate VM Azure HA cluster goes out-of-sync due to dynamic firewall address type.

When adding a new interface, some other interfaces have the wrong virtual MAC address.

When an HA management interface is configured, the GUI may not show the last interface entry in config system interface on several pages, such as the interface list, policy list, address list, and DNS servers page. This is a GUI-only display issue and does not impact the underlying operation of the affected interface.

Heartbeat packet loss issue at random times.

The System > HA page is missing from the GUI on 5K models.

HA events not synchronizing between members, leading to unexpected HA status.

Hardware session synchronization is showing as out-of-sync on primary and secondary.

Unexpected behavior occurred in the kernel when creating EMAC VLAN interfaces based on an aggregate interface with the new kernel 4.1.9.

The IPv6 neighbor cache configuration is missing after executing a reboot or flush command.

With an enabled hyperscale license, in some cases with exception traffic (like ICMP error traverse), the FortiGate may experience unexpected disruptions when handling the exception traffic.

First-time HA failover after upgrading causes long service interruption to NAT44.

Problem with synchronizing a high amount of routes to NP7 for hyperscale firewall.

Device is rebooting randomly when driver processes exception packets.

Hyperscale firewall creates a separate session and uses a different source port for IP fragment packets.

Failover on clustered web application using keepalived daemon does not work seamlessly.

IPv6 with hardware offloading and IPS drops traffic (msg="anti-replay check fails, drop).

Firewall policy change causes high CPU spike with IPS engine.

Unexpected behavior in IPS engine when executing diagnose test application ipsmonitor 44.

Source MAC changes and the packet drops due to both sides of the session using the same source MAC address.

IPS engines do not release memory after stopping traffic more than one hour.

IPS daemon usage issue when notifying device vulnerability information to WAD.

Constant reloading of the external domain table is causing high CPU due to lock contention when reloading the table.

Constant reloading of the shared memory external domain table is causing high CPU usage due to lock contention when reloading the table.

RSH subsession timeout when IPS is enabled.

The vpn-id-ipip encapsulated IPsec tunnel with NPU offloading cannot be reached by IPv6.

Proxy ARP stops working for a client connected to a dialup IPsec when the previous VPN was established and is deleted.

VM running FIPS cipher mode does not show AES-CBC ciphers when configuring IPsec in the GUI.

Forwarded broadcast traffic on ADVPN shortcut tunnel interface dropped.

IPsec performance drops after upgrade on AWS.

File transfer stops after a while when offloading is enabled.

In FGSP, IKE routes are not removed from the kernel when secondary-add-ipsec-routes is disabled.

Traffic through a shortcut got dropped after an HA failover.

The forward traffic log show exabytes of data being sent and received from external to external IP addresses in multiple VDOMs.

When viewing logs on the Log & Report > System Events page, filtering by domain\username does not display matching entries.

In Forward Traffic logs, the Policy ID column is blank.

Log Viewer: filter by Date/Time does not show correct result.

diagnose sys logdisk smart does not work for NVME disk models.

The FortiGate does not generate deallocate/allocate logs of the first IP pool when the first IP pool has been exhausted.

IPS alert email not being sent when IPS attack event has triggered.

Traffic log can show exabytes of data sent and received when generating log task is triggered from userspace.

Secondary FortiGate log cannot be viewed from primary FortiGate in HA.

Forward traffic log has unexpected symbols in the end for some logs.

An error condition occurs in WAD caused by multiple outstanding requests sent from client to server with UTM enabled.

CPU usage issue in Proxyd caused by the absence of TCP Teardown.

Unexpected behavior in WAD due to the activation of firewall protocol options with both client and server comfort features enabled.

Emails are blocked when proxy-based policy with either AntiVirus or Email Filter security profiles enabled.

Memory usage issue caused by the WAD user info process while authenticating the LDAP users.

Kerberos authentication stops working after the upgrading to 7.2.3.

Proxy-based deep inspection connection issue occurs.

Unable to upload file to the application server in server-load-balance setup.

link-down-failover does not bring the BGP peering down.

Auto-link fails if the FortiGate device initiating the FGFM connection is using an interface with a VRF not set to the default, 0.

OSPF summary address for route redistribution from static route via IPsec VPN always persists.

Redistributed BGP routes to the OSPF change its forward address to the tunnel ID.

SD-WAN SLA log information has incorrect inbound and outbound bandwidth values.

SD-WAN performance SLA statistics on secondary unit's GUI section are not synchronized with the primary and has stale data.

With ICMP asymmetric routing enabled, ICMP local-in/local-out reply packets will still only return through the original path, in order to maintain the ping SLA.

Speed test result is not accurate.

High CPU due to PIMD/NSM and multicast session not being offloaded.

DHCP relay fails after a period of time with SD-WAN.

config redistribute routing subsections cannot be configured when in workspace mode.

BGP neighbor group configured with password is not working as expected.

Search broken on SD-WAN Rules tab's Source/Destination omniselect.

FortiGate removing SD-WAN routes when network address is specified as the gateway of an SD-WAN member.

SD-WAN rules list in the GUI should show the interface members in priority order instead of alphabetical order.

FortiGate 40F-3G4G not adding LTE dynamic route to route table.

Static routes are installed on hub FortiGate with add-route disabled in ADVPN scenario.

The Network dashboard may not load if the administrator disables SD-WAN Interface under System > Feature Visibility.

When using automation email action to reference the result of a previously executed automation CLI script action, there is a 16 KB size limit for the script output.

In a configuration with a connected FortiAP-U, the FortiAP & FortiAP-S & FortiAP-W2 & FortiAP-U Command Injection in CLI security rating test fails and suggests an upgrade to 7.0.4, even though the FortiAP is on the latest version (7.0.0).

Advanced GCP connector does not resolve if one element does not exists.

Allow comments and IP addresses to be on the same line for external IP address threat feeds.

Send Fabric API calls with pagination filter.

Unexpected behavior in Security Fabric daemon (CSFD) caused by triggering HA failover while using Security Fabric.

Threat feeds with name starting with "g-" are not allowed on non-VDOM FortiGate.

Azure SDN connector always uses HA management port for DNS resolve. This might not work on premises where the HA management port does not have a public IP address assigned.

Configuring thousands of mac-addr-check-rule in portal makes the CPU spike significantly if several hundreds of users are connecting to the FortiGate, thus causing SSL VPN packet drops.

SSL VPN fails to connect to graph.microsoft.com when doing Azure auto-login.

Customer bookmark (*.tr***.pt) is not accessible when using SSL VPN web mode.

PC cannot get IP from DHCP server due to find duplicate ip and causes the dialup SSL VPN to fail.

Problem loading some graphs trough SSL VPN web mode after upgrading.

SSL VPN DTLS tunnel is unavailable after changing the SSL VPN listening port.

FortiGate adds extra parenthesis and causes clicking all links to fail in SSL VPN web mode.

SSL VPN web mode connection to VMware vCenter 7 is not working.

Internal website is not displaying user-uploaded PDF files when visited through SSL VPN web mode.

SSL VPN web mode does not load when connecting to customer's internal site.

SSL VPN web mode to RDP broker leads to connection being closed.

FortiGate misses the closing parenthesis when running the function to rewrite the URL.

Webpage opened in SSL VPN web portal is not displayed correctly.

RDP freezes in web mode with high CPU usage of SSL VPN process.

Decrease in download speeds observed for SSL VPN users when over 2000 users are connected.

Internal website access issue with SSL VPN web portal.

Found bad login for SSL VPN web-based access when enabling URL obscuration.

Disconnecting from SSL VPN using the SSL-VPN widget does not disconnect the SSL VPN tunnel.

Web mode bookmark showing blank page due to JS rewrite.

Some buttons in URL are not working in SSL VPN web mode.

SSL VPN process reaches 99% CPU usage when HTTP back-end server resets the connection in the middle of a post request.

When a user needs to enter credentials through a pop-up window, the key events for modification key detected by SDL were ignored.

FortiGate will intermittently stop accepting new SSL VPN connections across all VDOMs.

The HPE iLO 5 web server is not able to load properly from the SSL VPN portal.

FortiOS check would block iOS and Android mobile devices from connecting to the SSL VPN tunnel.

SSL VPN web portal not loading internal web page.

Specific SAP feature is not working with SSL VPN web mode.

SSL VPN web mode is not working as expected for customer's web server.

SSL VPN web portal HTTP bookmark forwarded site throws Java error.

Internal website keeps asking for credential with SSL VPN web mode.

The external DHCP server is not receiving hostnames in SSL VPN and DHCP relay.

DHCP option 12 hostname needed for SSL VPN with external DHCP servers.

Update SSL VPN host check logic for unsupported OS.

SSL VPN service over PPPoE interface does not work as expected if the PPPoE interface is configured with config system pppoe-interface.

config system pppoe-interface
    edit <name>
        set device <string> 
        set username <string>
        set password <password>
    next
end

config vpn ssl settings
    set source-interface <PPPoE_interface_name>
end

This issue is also observed on VNE tunnel configurations.

SSL VPN tunnel down log message not generated when an IP address is disassociated before the old tunnel times out.

Upon upgrade, the link to FortiSwitch stays down with QSFP.

Redirected traffic should not hit the firewall policy when allow-traffic-redirect is enabled.

One discovery one transmit buffer was allocated and was not released on connection terminations.

Unable to configure more than one NAC policy using the same EMS tag for different FortiSwitch groups.

WiFi & Switch Controller > FortiSwitch Ports page does not show VLANs exported to another tenant VDOM, which results in the VLAN being removed if saved from the GUI.

When a FortiSwitch port is reconfigured, the FortiGate may incorrectly retain old detected device data from the port that results in an unexpected number of detected device MACs for the port. Using diagnose switch-controller mac-cache show to check the device data can result in the Device Information column being blank on the WiFi & Switch Controller > FortiSwitch Ports page or in the Assets widget.

Security rating shows an incorrect warning for unregistered FortiSwitches on the WiFi & Switch Controller > Managed FortiSwitches.

FortiGate loses QoS ip-dscp-map configuration after reboot.

The vlan-optimization {enable | disable} and vlan-all-mode all configuration options disappear after upgrade or reboot.

diagnose sys logdisk smart does not work for NVMe disk models.

GUI shows conflicts error message when configuring a secondary IP address after allow-subnet-overlap is enabled.

CPU usage issue is observed caused by reloading the system when the system has cfg-save set to revert.

Not all ports are coming up after an LAG bounce on 8 × 10 GB LAG with ASR9K. Affected platforms: FG-3960E and FG-3980E.

When backing up the configuration to a USB disk, if the file name is the same as specified under System > Settings > Start Up Settings > USB auto-install, an Invalid file name error is displayed.

QSFP and QSFP+ Fortinet transceivers are not operational on FG-3401E.

FG-100F fails to boot when FortiOS image binary is larger than 94 MB.

FortiGate 200F interfaces stop passing traffic after some time.

DAC cable support is unstable on the FortiGate 1101E.

False alarm of the PSU2 occurs with only one installed.

FortiGate 40F-3G4G WWAN connection unstable on Verizon Carrier.

CPU usage issue caused by the new Linux kernel.

The FEC configuration under the interface is not respected when port23 and port24 are members of an LACP and the connection is 100G. Affected platforms: FGT-340xE, FGT-360xE.

If the original packet was forwarded with NAT, generated ICMP error is routed back to SNAT'ed address.

If a device is rebooted that has an ipsec-STS-timeout configured or the user configures the ipsec-STS-timeout before any NPU tunnel is created, NPU will send random STS messages that have an invalid tunnel index and trigger NP6XLite error messages.

SNMP multicast counters are not increasing.

When an IPsec tunnel is configured with a different VRF than the underlying physical interface, and traffic is offloaded, the session expires even when traffic is flowing through it.

ssh-rsa should be disabled under the SSH server_host_key_algorithm.

Dashboard loads slowly and csfd process has high CPU usage.

If the firewall session is in check-new mode, FortiOS will not flush its NPU offload entry when there is a MAC address update of its gateway.

Host TX dropped counter incrementing and connections failing when throughput reaches 40 Gbps.

When a user is logged in as a VDOM administrator with restricted access and tries to upload a certificate (System > Certificates), the Create button on the Create Certificate pane is greyed out.

Unbalanced throughput on LAG members with LAG enhancement feature enabled.

Sensor showing temperature of 0.00 Celsius.

Traffic dropped as the matching SessionID is being deleted from session table in 20 seconds.

Unable to configure dscp-based-priority when traffic-priority dscp is configured under system global.

Auto-script causes FortiGate to repeat commands.

LAG interface has NOARP flag after interface settings change.

Daylight saving time is not applied for Cairo time zone.

Interface could not be brought up if it was part of a virtual switch.

Incorrect temperature calculation appears in sensor list on FG-8xF, FWF-8xF, FG-9xE, FG-10xE, FG-20xE, and FG-14xE.

FSTR session ticket zero causes a memory leak.

FortiGate 1801F in transparent mode cannot reply to an SNMP query.

IPv6 addresses configured on EMAC VLAN interfaces showing FTP flag after upgrade.

QSFP/QSFP+ port23/port24 are down after upgrading to 7.0.11 on FG-3401E.

execute sensor list has blank lines in output.

Port speed 1000auto could not link up with a Cisco switch.

The crashlog might show a Node.JS restarted error, Failed to fetch web-ui.node-exports: Error: connect ECONNREFUSED, if the HTTPSD is being killed during conserve mode, stuck in some API calls, or slow response during system super busy.

The FortiGate may display a false alarm message and subsequently initiate a reboot.

DST changes not reflected for timezone 16. The dates are incorrect on the DST for this specific timezone (Santiago-Chile).

dnsproxy process aborts due to stack buffer overflow being detected upon function return.

ISP traffic is failing with the LAG interfaces on upstream switches.

Unexpected behavior caused by the Linux Out of Memory (OOM) killer when memory is very low.

Last reboot reason: power cycle after rebooting due to a kernel panic is misleading.

When a non-zero DSCP copied from ingress to egress packet for NAT64, the IP checksum is calculated incorrectly.

Transparent mode FortiGate does not reply to SYN ACK when communicating with FortiManager.

Ports are flapping and down on the FortiGate 3980E.

High system CPU and multiple daemons enter D state on the FortiGate 4401F.

GUI and CLI time mismatch for Central America (Mexico) time zone.

DNS does not respond to short name queries.

For FIPS-CC mode, the strict check for basic constraints should be removed for end entity certificates.

CPU usage issue observed in dnsproxyd caused by unused wildcard FQDN.

Administrator with read-only access to management permissions cannot perform a configuration backup in the GUI.

When performing factoryreset2, the IP addresses on "a" and "b" are set to default.

CPU usage issue observed in hasync daemon when session count is large.

FortiGate does not respond to ARP requests for the IP address on the WAN port when the interface is configured as EMAC.

System goes into halt state with Error: Package validation failed... message in cases where there are no engine files in the FortiGate when the BIOS security level is set to 2.

The DSL modem on the firewall does not work after the device starts.

IPv6 local-in ping6 to management interface failed when newly configured.

MAC flapping on switch when UDP packets passthrough VWP multiple times with ASIC offload.

After a manual system administrator password change, the updated password-expire is not received by the FortiManager auto-update.

Running diagnose sniffer filter with blank or empty quotation marks ("" or " ") is not working.

On D-series FortiGates, a false alarm during system integrity check failure causes the firewall to reboot.

Review the temperature sensor for the SoC4 system.

Traffic over vpn-id-ipip tunnel is blocked when npu-offload is disabled in the VPN phase 1 interface and the policy has UTM enabled.

An error condition occurred in httpsd and newcli when trying to generate a TAC report from the GUI and CLI, respectively.

When L3 or L4 hashing algorithm is used, traffic is not forwarded over the same aggregate member after being offloaded by NP7.

LTE modem is missing after upgrading.

NAT port is out of range, causing the PBA index to be out of range.

FortiOS does not accept an installation script from FortiManager when creating an extender-profile with login-password-change is set to yes.

Unable to load SNMP page with SSO Admin.

Multiple spawns of hotplug process consuming high CPU resources.

Memory usage issue caused by excessive log files.

When a user's membership in AD or port range is changed, all of the user sessions are cleared.

SSL VPN and firewall authentication SAML does not work when the application requires SHA-256.

Some embedded SSL certificates entered the Error state after enabling FIPS-CC.

Dynamic address only has 100 IP addresses while FSSO group lists all 56K ACI endpoints.

Fortinet_GUI_Server certificate auto-regenerates every day.

The SAML assertion is truncated in samld when the payload size is huge.

Adding a new group membership to an FSSO user terminates all the user's open sessions.

FortiGate is sending Class(25) AVP with wrong length in RADIUS accounting when using 2FA with PUSH or external tokens.

When generating guest users according to the settings in the guest group, the expiration time of guest users will automatically add an extra two hours.

An Error condition occurs during the processing of the UDP packets when device identification is activated on an interface.

Device detection sometimes does not identify the correct IP addresses of devices.

CA bundle (CRDB) to support DigiCert second-generation (G2) full CA and intermediate CA chain.

EAP proxy daemon may keep reloading after updating the certificate bundle.

Fas daemon crashing on FortiGate.

On the System > Replacement Messages page, the guest user email template cannot restore to the to default value.

After creating a new guest user, the administrator cannot view the user's password in plaintext in the GUI.

AWS external account list supports regional endpoints.

In the periodic status check of the OCI VM status, too many API calls caused a lot of 429 errors.

Copy of files between a physical server and Windows Server is slow.

Traffic drops in FortiGate HA A-A, AutoScale in Azure.

FortiGate VMs in an HA cluster deployed on the Hyper-V platform may get into an unresponsive state where multiple services are impacted: GUI management, CLI commands, SSL VPN sessions, DHCP assignment, traffic throughput, and reboot function.

Event log alert Write Permission Violation to read-only file on VMware after taking snapshot.

VPN errors after upgrade: Malformed Packets, AUTHENTICATION_FAILED messages, and INVALID_KE_PAYLOAD.

FortiGate-VM KVM with MLX5 not responding to ARP in RHEL environment.

In a policy-based VDOM, changes are not applied when adding an external threat feed category in the URL Category field.

Web filter override expiry date in the GUI may be one hour off if daylight saving time (DST) is observed.

When there are extra large number of managed FortiAP devices (500+) and large number of WiFi clients (5000+), the Managed FortiAP page and FortiAP Status widget in the GUI can take a long time to load. This issue does not impact FortiAP operation.

When accessing the Managed FortiAP/Switch view with a large number of devices in the topology, the page would take a long time to load.

RADIUS CoA does not work in some cases.

After initial packets, FG-101F stops forwarding wired traffic over FAP-23JF LAN tunneled with a dynamic VLAN VAP.

Unable to create FortiAP profile in the GUI for dual-5G mode FortiAP U231F/U431F models.

In auth-logon and auth-logout logs, Wi-Fi users with random public IP addresses are observed.

Intermittent behavior in Hostapd caused by enabling/disabling fast-bss-transition.

FAP-431F is deauthenticating clients after roaming when DHCP enforcement is enabled on the SSID, even when the client gets IP from DHCP.

Enable DFS channels on wtp-profile for FortiAP 431G and FortiAP 433G in region A/S/N(No-Brazil).

An error case occurs in CAPWAP when the SSID interface, which has a VLAN interface over it, is deleted.

On the WiFi & Switch Controller > Managed FortiAPs page of a non-management VDOM, the Register button is unavailable in the Device Registration pane.

After client device information is updated, the session is closed even though all information from the session still matches the policy.

FortiOS 7.2.6 is no longer vulnerable to the following CVE Reference:

• CVE-2023-26207

FortiOS 7.2.6 is no longer vulnerable to the following CVE Reference:

• CVE-2023-36555

FortiOS 7.2.6 is no longer vulnerable to the following CVE Reference:

• CVE-2023-37935

FortiOS 7.2.6 is no longer vulnerable to the following CVE Reference:

• CVE-2023-36641