Fortinet Patches Eight Critical Flaws in FortiOS, FortiManager and FortiAnalyzer

TL;DR

Fortinet published eight critical security advisories on November 10, 2026, covering FortiOS, FortiManager, FortiAnalyzer and FortiSASE. These Fortinet critical vulnerabilities score between 9.0 and 9.8 on CVSS. The worst, CVE-2026-126170, can let an unauthenticated attacker run code on FortiManager and FortiAnalyzer when the JSON API is enabled.

Six of the eight flaws need no login, and several target FortiManager and FortiAnalyzer services. Fortinet found almost all of them internally, with help from the AI model Claude Mythos. Some fixes are still “upcoming,” so apply workarounds where patches are not yet available.

Notable CVEs

Why It Matters

FortiManager and FortiAnalyzer control and log entire fleets of FortiGate firewalls. As a result, a takeover can ripple across a whole network. Attackers know this well. CISA’s Known Exploited Vulnerabilities catalog already lists 32 Fortinet flaws.

So far, none of the eight new CVEs appears in that catalog, and Fortinet reports no attacks. However, Fortinet’s own scores mark several bugs as having proof-of-concept or functional exploit code. In addition, the HA virtual patch carries the label “FG-VD-61445.0day.”

How the Attack Works

FortiManager and FortiAnalyzer

• CVE-2026-126170 (CVSS 9.8): An output encoding flaw in the JSON RPC API “may allow an unauthenticated attacker to execute unauthorized code or commands.” The API is disabled by default.
• CVE-2026-126262 (CVSS 9.3): SQL injection through crafted OFTP packets lets an unauthenticated attacker run code. JP Morgan Chase’s XOR team also reported it.
• CVE-2026-126261 (CVSS 9.0): An improper authorization bug in FGFM lets an attacker who can reach the FGFM port execute commands.
• CVE-2026-126260 (CVSS 9.0): A pre-auth SSRF over the OFTP port.
• CVE-2026-126229 (CVSS 9.1): An authenticated admin can reach other VDOMs through crafted HTTP requests.

FortiOS and FortiSASE

• CVE-2026-126254 (CVSS 9.6): A numeric truncation error in the BGP daemon lets a configured iBGP neighbor push malformed attributes to all connected routers.
• CVE-2026-126253 (CVSS 9.3): An OSPF authentication bypass lets an adjacent, unauthenticated attacker broadcast forged route updates.
• CVE-2026-126259 (CVSS 9.0): Missing authentication in HA lets an attacker run commands as super admin. It only affects FGSP with standalone-config-sync, or autoscale.

Affected Versions

• FortiOS 7.2.0 through 7.2.13, 7.4.0 through 7.4.12, 7.6.0 through 7.6.7, and 8.0.0 through 8.0.1
• FortiManager and FortiAnalyzer 7.2, 7.4, 7.6 and 8.0 branches, depending on the flaw
• FortiManager Cloud, FortiAnalyzer Cloud, FortiAnalyzer-BigData, FortiSASE and FortiSASE-Sovereign

Patch and Mitigation

For FortiOS, upgrade to 7.2.14, 7.4.13, 7.6.8 or 8.0.2. For FortiManager and FortiAnalyzer, move to 7.2.13, 7.4.12, 7.6.8 or 8.0.2, depending on the advisory. Note that some fixes, including FortiManager 8.0.3 and FortiOS 7.6.8 for the HA bug, are listed as “upcoming.”

Until then, disable the JSON API with “set rpc-permit none” on admin profiles. Also apply the FortiGuard virtual patch for the HA flaw, and keep OFTP and FGFM ports off the internet.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.