TL;DR Fortinet published eight critical security advisories on November 10, 2026, covering FortiOS, FortiManager, FortiAnalyzer and FortiSASE. These Fortinet critical vulnerabilities score between 9.0 and 9.8 on CVSS. The worst, CVE-2026-126170, can let an unauthenticated attacker run code on FortiManager and FortiAnalyzer when the JSON API is enabled. Six of the eight flaws need no login, and several target FortiManager and FortiAnalyzer services.

Fortinet has disclosed critical security flaws affecting FortiManager, FortiAnalyzer, and FortiOS, including weaknesses that could let attackers execute code without logging in.

Fortinet has disclosed critical security flaws affecting FortiManager, FortiAnalyzer, and FortiOS, including weaknesses that could let attackers execute code without logging in. Published on November 10, 2026, the disclosures cover management APIs, device communication services, routing, and specific high availability setups. Attack requirements differ, making enabled features and network access central to assessing exposure. Critical Fortinet Flaws Patched The highest-rated issue, CVE-2026-126170, carries a CVSS score of 9.8. Tracked as FG-IR-26-219 , it involves JSON injection in the JSON-RPC API used by FortiManager and FortiAnalyzer. When the JSON API is enabled, crafted requests could allow an unauthenticated attacker to execute code or commands. Systems using the API for automation need close review. Another critical flaw, CVE-2026-126261, affects FortiManager’s FGFM service. Rated 9.0 and tracked as FG-IR-26-275 , the authorization weakness allows attackers who can reach the FGFM port to send crafted packets and potentially execute code. The problem occurs before the registration password is verified, placing the service itself within the attack path. CVE-2026-126262, tracked as FG-IR-26-276 and rated 9.3, exposes FortiAnalyzer and FortiManager systems with FortiAnalyzer features enabled to SQL injection through OFTP. An attacker does not need to log in, and successful exploitation could lead to code execution. This makes access to the log transfer service an important part of exposure checks. The disclosures follow the October security releases previously covered in Cyber Security News’ Fortinet patch warning . Fortinet released updates before publishing the detailed advisories, giving customers time to upgrade. However, administrators should not assume that installing one October build resolves every November finding, because fixes vary by vulnerability and software branch. Fortinet’s FGFM advisory lists FortiManager 8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.5, and 7.2.0 through 7.2.8 as affected by CVE-2026-126261. Fixed releases are 8.0.1, 7.6.8, 7.4.6, and 7.2.9, respectively. Fortinet marks this issue as not known to have been exploited when published. CVE-2026-126260, tracked as FG-IR-26-274, adds a separate OFTP risk. Rated 9.0, this pre-authentication server-side request forgery flaw affects FortiAnalyzer and FortiManager with FortiAnalyzer features enabled. It should not be confused with confirmed remote code execution. Its impact involves causing the server to make requests, while the SQL injection issue provides a different attack path. These weaknesses also show why protecting the browser login page is not enough. FGFM uses TCP port 541, while OFTP uses TCP port 514. Administrative login restrictions do not directly protect those services. Earlier FortiManager compromise reporting showed how access to a central management appliance could expose sensitive information linked to hundreds of managed firewalls. Routing and Access Controls Also Affected The broader release includes CVE-2026-126254, a 9.6-rated numeric truncation flaw in FortiOS BGP handling that requires traffic from a configured iBGP neighbor. CVE-2026-126253, rated 9.3, concerns an OSPF authentication bypass that could permit forged routing advertisements. These are routing risks, not interchangeable examples of management server code execution. CVE-2026-126229, rated 9.1, could allow an authenticated administrator to access other virtual domains, or VDOMs, outside their permitted scope. Separately, CVE-2026-126259 carries a 9.0 rating and allows command execution with super-admin privileges in specific FortiOS setups involving FGSP with standalone configuration synchronization, or affected autoscale configurations. Neither issue should be described as affecting every deployment equally. Fortinet’s security release guidance urges customers to prioritize exposed systems, back up configurations, and monitor unauthorized changes. For CVE-2026-126170, the 8.0 branch requires particular attention because 8.0.3 was listed as forthcoming. Disabling unused JSON API access with set rpc-permit none reduces exposure while administrators verify the latest advisory and plan the appropriate update. The post Critical Fortinet Flaws Expose FortiManager and FortiAnalyzer to Remote Code Execution Without Login appeared first on Cyber Security News .

Versions of FortiAnalyzer, FortiManager and their cloud services may let an unknown attacker send a crafted web request that executes unauthorized.

Versions of FortiAnalyzer, FortiManager and their cloud services let a logged‑in administrator send specially crafted web requests to see data in other.

Versions 7.2.0-7.2.8, 7.4.0-7.4.5, 7.6.0-7.6.7, and 8.0.0 of FortiManager can be accessed without authentication if an attacker reaches the FGFM.

New hardcoded credential CVE! CVE-2026-126181 - https://www.cve.org/CVERecord?id=CVE-2026-126181 Fortinet - FortiManager A use of hard-coded credentials vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions may allow an adjacent-network authenticated attacker with user permission to join the FGFM configuration-sync mesh of the affected FortiGate deployment via the default pre-shared key.

CVE-2026-126261 describes an improper authorization vulnerability in multiple Fortinet FortiManager versions. An unauthenticated attacker able to reach the FGFM port could exploit this flaw by sending crafted FGFM packets to execute arbitra

Versions of FortiAnalyzer and FortiManager that handle OFTP traffic may let an attacker send specially crafted packets and run commands on the device.

Fortinet disclosed four critical vulnerabilities across FortiClient, FortiManager and FortiAnalyzer, including unauthenticated code-execution paths and a user-interaction flaw in FortiClient.

Fortinet announces frontier AI hardening releases for a range of products including FortiOS, FortiManager, FortiAnalyzer, FortiMail, and FortiAuthenticator.…

Fortinetが11月10日、FortiOS・FortiManager・FortiAnalyzerの重大脆弱性を公表。CVSS 9.8のCVE-2026-126170など8件の攻撃条件、影響製品、修正版、未修正時の回避策と情シス向け確認事項を整理

Fortinet heeft op 10 november 2026 kritieke beveiligingslekken bekendgemaakt die FortiManager, FortiAnalyzer en FortiOS treffen. Sommige van deze kwetsbaarheden kunnen aanvallers toestaan code uit te voeren zonder dat er eerst ingelogd hoeft te worden. De specifieke vereisten voor het uitbuiten van de lekken variëren per kwetsbaarheid. De hoogst gewaardeerde kwetsbaarheid, CVE-2026-126170 met een CVSS-score van 9.8, betreft een JSON-injectie in de JSON-RPC API van FortiManager en FortiAnalyzer. Indien de JSON API is ingeschakeld, kan een succesvolle exploitatie leiden tot ongeauthenticeerde code-uitvoering via speciaal vervaardigde verzoeken. Het uitschakelen van ongebruikte JSON API-toeg...

Between November 10 and 11, 2026, Fortinet reported a series of critical vulnerabilities in its products, including FortiClient, FortiManager, FortiAnalyzer, and FortiMail. These flaws may allow unauthorized attackers to remotely execute arbitrary code or commands, posing security risks to customers

TPx Communications incident on November 10, 2026: Fortinet has announced security vulnerabilities affecting certain firewall and management technologies, including FortiOS, FortiManager, and Started 9:13 PM UTC, resolved ongoing (● 7m). Affected: MSx Firewalls.

  Fortinet issued 89 security advisories on November 11, covering close to 100 vulnerabilities across its product lineup, with roughly 17 rated critical and nearly 80 classified as high severity. The release stands as one of the company's largest single-day patch drops, touching nearly every major product in its portfolio. FortiMail received the heaviest concentration of critical fixes. FortiAuthenticator, FortiOS, FortiManager and FortiAnalyzer followed close behind. FortiSASE and FortiClient also received updates resolving critical issues. The critical vulnerabilities span a wide range of attack classes. Among those fixed are arbitrary code execution flaws, authentication bypass conditions, account takeover paths, unauthorized access to Virtual Domains (VDOMs), server-side request execution, and a command execution bug that could allow an attacker to run commands with super-admin privileges. FortiMail-specific issues include paths that expose secure email accounts and allow IBE webmail session compromise, along with flaws enabling unauthorized webmail password resets. High-severity fixes address cross-site scripting, code injection, arbitrary file uploads, denial-of-service conditions, man-in-the-middle attack vectors, privilege escalation, and information disclosure. Fortinet has not attributed any of these vulnerabilities to active exploitation in the wild. A Notable Standalone Finding One vulnerability drew particular attention from the security research community. Kevin Joensen, a principal security consultant at Baldur Security, identified and named a FortiClient flaw he called "Fortinet2Shell." The root cause is a CORS misconfiguration that allows attacker-controlled web pages to communicate with a local service running on the target machine. If a victim visits a malicious website while FortiPAM is enabled, an attacker could achieve arbitrary code execution on that system. The flaw is conditional but the bar for triggering it is low: simply visiting a crafted page is enough. Joensen's research illustrates how client-side software that communicates with local services over HTTP remains a consistent attack surface, one that often gets less scrutiny than server-facing products. AI in the Testing Pipeline The scale of this release tracks directly to a shift in how Fortinet approaches internal security testing. Carl Windsor, the company's CISO, confirmed that Fortinet has been running frontier AI models alongside its own on-premises models in vulnerability testing for several months. The program operates in two phases. In the first, models analyzed firmware without access to source code, mapping how products function and identifying potential attack vectors. Those leads were then validated through penetration testing and red teaming. The black-box phase returned few directly exploitable flaws, but the models showed strong capability in comparing firmware versions across releases and building proof-of-concept exploits for bugs that had already been patched. The second phase involved source code analysis. Across more than 100 tests spanning 30 product families, roughly 40 percent of findings were genuine vulnerabilities, 30 percent were false positives, and the remaining 30 percent were security improvements that did not rise to the level of exploitability. Windsor did not frame AI-assisted testing as a silver bullet. He acknowledged that the same tools available to Fortinet's internal teams are available to attackers, and he warned that the gap between public disclosure and active exploitation is getting shorter. "The window between disclosure and exploitation continues to shrink, and we expect it to keep shrinking," he said. The Urgency Behind Early Disclosure Fortinet's decision to hold technical details until a fixed release is available reflects a deliberate strategy. Once a patch ships, researchers and threat actors alike can reverse-engineer the changes to identify what was fixed and where. For organizations running unpatched versions, that creates a narrow and shrinking window of practical anonymity. Windsor noted that internet-facing systems should be prioritized for immediate patching. For organizations that cannot apply fixes right away, interim steps include restricting administrative access to trusted IP ranges, keeping FortiManager off public networks, enforcing strong and unique credentials, and requiring multi-factor authentication for all admin accounts. He was direct that none of these measures replace upgrading the software. Fortinet's PSIRT page at fortiguard.com/psirt carries the full list of advisories and affected version ranges. The November batch comes weeks after the company released urgent fixes for FortiOS and FortiManager, some of which were also flagged as AI-assisted discoveries. The cadence suggests Fortinet is now committing to more frequent and larger release cycles as a direct consequence of expanding its AI testing program, a move that will likely increase pressure on enterprise security teams to maintain tighter patch windows across Fortinet deployments.

A New Wave of Fortinet Security Flaws Puts Network Management Infrastructure at Risk Fortinet has disclosed a collection of serious security vulnerabilities affecting FortiManager, FortiAnalyzer, and FortiOS, including multiple flaws that could allow remote attackers to execute arbitrary code or commands without authentication. Published on November 10, 2026, the security disclosures cover several attack surfaces, including JSON-RPC APIs, device-management communication services, file-transfer protocols, routing mechanisms, and specialized synchronization configurations.