TL;DR Fortinet published eight critical security advisories on November 10, 2026, covering FortiOS, FortiManager, FortiAnalyzer and FortiSASE. These Fortinet critical vulnerabilities score between 9.0 and 9.8 on CVSS. The worst, CVE-2026-126170, can let an unauthenticated attacker run code on FortiManager and FortiAnalyzer when the JSON API is enabled. Six of the eight flaws need no login, and several target FortiManager and FortiAnalyzer services.

Certain versions of FortiOS can be tricked into accepting special network packets without checking who sent them.

Certain versions of FortiOS can mishandle specially crafted iBGP information, allowing a neighboring router to send bad data to all routers it talks to.

Certain versions of FortiOS may allow a person without login credentials to send specially crafted requests that cause the device to broadcast false.

Fortinetは同社UTM機器のOS「FortiOS」に複数の脆弱性を公開。そのうち3件がクリティカルレベルに分類されており、利用者への注意喚起が行われている。

Fortinetは、同社UTM機器に搭載されているOS「FortiOS」に関する複数の脆弱性を明らかにした。このうち3件の重要度を「クリティカル」としており、利用者に注意を呼びかけている。 ：Security NEXT

Fortinetは、同社UTM機器に搭載されているOS「FortiOS」に関する複数の脆弱性を明らかにした。このうち3件の重要度を「クリティカル」としており、利用者に注意を呼びかけている。 ：Security NEXT

Fortinet has disclosed critical security flaws affecting FortiManager, FortiAnalyzer, and FortiOS, including weaknesses that could let attackers execute code without logging in.

Fortinet announces frontier AI hardening releases for a range of products including FortiOS, FortiManager, FortiAnalyzer, FortiMail, and FortiAuthenticator.…

Fortinetが11月10日、FortiOS・FortiManager・FortiAnalyzerの重大脆弱性を公表。CVSS 9.8のCVE-2026-126170など8件の攻撃条件、影響製品、修正版、未修正時の回避策と情シス向け確認事項を整理

Fortinet has disclosed critical security flaws affecting FortiManager, FortiAnalyzer, and FortiOS, including weaknesses that could let attackers execute code without logging in. Published on November 10, 2026, the disclosures cover management APIs, device communication services, routing, and specific high availability setups. Attack requirements differ, making enabled features and network access central to assessing exposure. Critical Fortinet Flaws Patched The highest-rated issue, CVE-2026-126170, carries a CVSS score of 9.8. Tracked as FG-IR-26-219 , it involves JSON injection in the JSON-RPC API used by FortiManager and FortiAnalyzer. When the JSON API is enabled, crafted requests could allow an unauthenticated attacker to execute code or commands. Systems using the API for automation need close review. Another critical flaw, CVE-2026-126261, affects FortiManager’s FGFM service. Rated 9.0 and tracked as FG-IR-26-275 , the authorization weakness allows attackers who can reach the FGFM port to send crafted packets and potentially execute code. The problem occurs before the registration password is verified, placing the service itself within the attack path. CVE-2026-126262, tracked as FG-IR-26-276 and rated 9.3, exposes FortiAnalyzer and FortiManager systems with FortiAnalyzer features enabled to SQL injection through OFTP. An attacker does not need to log in, and successful exploitation could lead to code execution. This makes access to the log transfer service an important part of exposure checks. The disclosures follow the October security releases previously covered in Cyber Security News’ Fortinet patch warning . Fortinet released updates before publishing the detailed advisories, giving customers time to upgrade. However, administrators should not assume that installing one October build resolves every November finding, because fixes vary by vulnerability and software branch. Fortinet’s FGFM advisory lists FortiManager 8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.5, and 7.2.0 through 7.2.8 as affected by CVE-2026-126261. Fixed releases are 8.0.1, 7.6.8, 7.4.6, and 7.2.9, respectively. Fortinet marks this issue as not known to have been exploited when published. CVE-2026-126260, tracked as FG-IR-26-274, adds a separate OFTP risk. Rated 9.0, this pre-authentication server-side request forgery flaw affects FortiAnalyzer and FortiManager with FortiAnalyzer features enabled. It should not be confused with confirmed remote code execution. Its impact involves causing the server to make requests, while the SQL injection issue provides a different attack path. These weaknesses also show why protecting the browser login page is not enough. FGFM uses TCP port 541, while OFTP uses TCP port 514. Administrative login restrictions do not directly protect those services. Earlier FortiManager compromise reporting showed how access to a central management appliance could expose sensitive information linked to hundreds of managed firewalls. Routing and Access Controls Also Affected The broader release includes CVE-2026-126254, a 9.6-rated numeric truncation flaw in FortiOS BGP handling that requires traffic from a configured iBGP neighbor. CVE-2026-126253, rated 9.3, concerns an OSPF authentication bypass that could permit forged routing advertisements. These are routing risks, not interchangeable examples of management server code execution. CVE-2026-126229, rated 9.1, could allow an authenticated administrator to access other virtual domains, or VDOMs, outside their permitted scope. Separately, CVE-2026-126259 carries a 9.0 rating and allows command execution with super-admin privileges in specific FortiOS setups involving FGSP with standalone configuration synchronization, or affected autoscale configurations. Neither issue should be described as affecting every deployment equally. Fortinet’s security release guidance urges customers to prioritize exposed systems, back up configurations, and monitor unauthorized changes. For CVE-2026-126170, the 8.0 branch requires particular attention because 8.0.3 was listed as forthcoming. Disabling unused JSON API access with set rpc-permit none reduces exposure while administrators verify the latest advisory and plan the appropriate update. The post Critical Fortinet Flaws Expose FortiManager and FortiAnalyzer to Remote Code Execution Without Login appeared first on Cyber Security News .