Fortinet patches eight critical flaws across FortiOS and FortiManager

Fortinet patches eight critical flaws across FortiOS and FortiManager

10 November 2026: Fortinet has published eight critical advisories for FortiOS, FortiManager, FortiAnalyzer and FortiSASE, the worst scored 9.8 and reachable without logging in, and one of them has no fixed build yet on the newest 8.0 branch. Fortinet marks none of them as known to be exploited, and every one was found by its own product security team.

Not yet independently verified. Five of the eight advisories were read on Fortinet's own pages; the full list of eight comes from Spain's INCIBE-CERT, and we have not opened the remaining three Fortinet advisories (CVE-2026-126254, -126260 and -126262) ourselves. We will update this when it can be confirmed, and remove this note.

The worst one, and the fix that is not out yet

FG-IR-26-219, CVE-2026-126170, scores 9.8. Improper output encoding in the web interface of FortiManager, FortiAnalyzer, their cloud versions, FortiSASE-Sovereign and FortiAnalyzer BigData may let an unauthenticated attacker run code or commands with a crafted HTTP request. Spain's INCIBE-CERT notes that it needs the JSON API to be enabled. The 7.6 branch is fixed in 7.6.8, but the 8.0 fix comes in 8.0.3 and the BigData fix in 7.6.3, neither released. Until they ship, Fortinet's workaround is to set rpc-permit to none on administrator profiles.

FG-IR-26-275, CVE-2026-126261, scores 9.0. An attacker who can reach the FortiManager FGFM port, the channel firewalls use to register with their manager, may run code through crafted FGFM packets. FortiManager 8.0.1, 7.6.8, 7.4.6 and 7.2.9 fix it.

Three in FortiOS itself

• FG-IR-26-267, CVE-2026-126253, 9.3: the OSPF routing daemon in FortiOS and FortiSASE may let an unauthenticated attacker broadcast link-state advertisements, injecting routes into the network. Fixed in FortiOS 8.0.2, 7.6.8, 7.4.13 and 7.2.14; the 7.0 branch has to migrate to a fixed release. FortiSASE was fixed by Fortinet in 26.3.2, with nothing for customers to do.
• FG-IR-26-273, CVE-2026-126259, 9.0: missing authentication on high-availability traffic may let an unauthenticated attacker run commands as super admin with crafted HA packets, on firewalls running FGSP with standalone config sync, or autoscale. Fixed in FortiOS 8.0.1, 7.6.8, 7.4.13 and 7.2.14, with 7.0 to migrate. Fortinet also offers a virtual patch, FG-VD-61445.0day, in FMWP database update 26.082.
• CVE-2026-126254: INCIBE lists a denial of service that an iBGP peer can cause through BGP; we have not read Fortinet's own advisory for it.

FortiManager and FortiAnalyzer administrators

FG-IR-26-244, CVE-2026-126229, scores 9.1. It lets an authenticated administrator reach other administrative domains (VDOMs) through crafted HTTP requests, which matters most to managed service providers that run many customers on one FortiManager. FortiManager and FortiAnalyzer 8.0.2, 7.6.8 and 7.4.12 fix it; the 7.2 and 7.0 branches must migrate. INCIBE adds two OFTP flaws, a server-side request forgery (CVE-2026-126260) and an SQL injection (CVE-2026-126262).

For most estates the practical targets are FortiOS 7.6.8 or 7.4.13 on the firewalls and 7.6.8 on FortiManager and FortiAnalyzer, with FGFM and the management interfaces kept off the internet and the rpc-permit workaround applied on any 8.0 manager. Fortinet has a company profile in our catalogue.

Sources

• Fortinet PSIRT FG-IR-26-219 (CVE-2026-126170), 10 November 2026
• Fortinet PSIRT FG-IR-26-275 (CVE-2026-126261), 10 November 2026
• Fortinet PSIRT FG-IR-26-267 (CVE-2026-126253), 10 November 2026
• Fortinet PSIRT FG-IR-26-273 (CVE-2026-126259), 10 November 2026
• Fortinet PSIRT FG-IR-26-244 (CVE-2026-126229), 10 November 2026
• INCIBE-CERT: Multiples vulnerabilidades en productos de Fortinet (INCIBE-2026-855), 11 November 2026